ratonrat | 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1

Resubmissions

05/06/2026, 14:29

260605-rtq6kshw7t10

05/06/2026, 14:15

05/06/2026, 14:07

05/06/2026, 13:44

05/06/2026, 13:04

05/06/2026, 12:37

Analysis

user interaction
yes
max time kernel
308s
max time network
323s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
AutoClicker.exe
Size 1.1MB
Sample260605-rez5yaay4p
SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
MD5 913a423f66aa1c41e374e21a911a3c20
SHA1 449df612d0f02e868992faabfbf4d5d37c727936
SHA512 ee01f1a322e982bfd6618920e4ec9decf23317628f39dc9b771ff4f758fef3c9266cebbeaeb8ba1e4bbb1f0b683cba1aa3a533bce62a706e7dfd2a7d3bdd1f73
SSDEEP 24576:pRaZROMOm8FN7TjsPnzt2heeRhQbJpOQam1Mfu37d:zkxOm+7TjsPnztyDMBayMc
TLSH
T169455B5523A44199FE6AF0F68A52C106D6B17C4A12B6CB1F01B039B52F736B3DE1E31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ratonrat persistence stealer

Malware Config

Extracted

Family

ratonrat

Version

Free

e97cmalzv5.localto.net:13677

Mutex

05JsXI231Nb9brS1kcNYKqk

Attributes

assist
false
box
false
box_icon
No icon
box_msg
Hello, i'm the description of your raton client message box
box_title
Hello, im a title for your message box
defender
true
delay
0
hide_file
true
open_website
false
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
false
vm
false
website
https://t.me/sillyisafed

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000200000002ae97-498.dat	family_ratonrat
behavioral1/memory/4056-500-0x00000218176D0000-0x00000218179A6000-memory.dmp	family_ratonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3212	powershell.exe
3212	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4056	grAH.exe
1464	grAH.exe
2448	grAH.exe
2252	grAH.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\grAH.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\grAH.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
852	chrome.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2680	timeout.exe
2464	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134251420461968547"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\grAH.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Roaming\PlatformRuntime\grAH.exe\:Zone.Identifier:$DATA	grAH.exe
File opened for modification	C:\Users\Admin\Downloads\grAH.exe:Zone.Identifier	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
2712	chrome.exe
2712	chrome.exe
1464	grAH.exe
1464	grAH.exe
1464	grAH.exe
1464	grAH.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 2700	4500	chrome.exe	81
PID 4500 wrote to memory of 1820	4500	chrome.exe	82
PID 4500 wrote to memory of 1820	4500	chrome.exe	82
PID 4500 wrote to memory of 852	4500	chrome.exe	83
PID 4500 wrote to memory of 4740	4500	chrome.exe	84
PID 4500 wrote to memory of 4740	4500	chrome.exe	84
PID 4500 wrote to memory of 2320	4500	chrome.exe	86
PID 4500 wrote to memory of 2320	4500	chrome.exe	86
PID 4500 wrote to memory of 5008	4500	chrome.exe	87
PID 4500 wrote to memory of 5008	4500	chrome.exe	87
PID 4500 wrote to memory of 3824	4500	chrome.exe	88
PID 4500 wrote to memory of 3824	4500	chrome.exe	88
PID 4500 wrote to memory of 1812	4500	chrome.exe	90
PID 4500 wrote to memory of 1812	4500	chrome.exe	90
PID 4500 wrote to memory of 4992	4500	chrome.exe	91
PID 4500 wrote to memory of 4376	4500	chrome.exe	93
PID 4500 wrote to memory of 4376	4500	chrome.exe	93
PID 4500 wrote to memory of 4132	4500	chrome.exe	94
PID 4500 wrote to memory of 4132	4500	chrome.exe	94
PID 4500 wrote to memory of 4496	4500	chrome.exe	95
PID 4500 wrote to memory of 4496	4500	chrome.exe	95
PID 4500 wrote to memory of 4548	4500	chrome.exe	96
PID 4500 wrote to memory of 4000	4500	chrome.exe	97
PID 4500 wrote to memory of 2712	4500	chrome.exe	98
PID 4500 wrote to memory of 2116	4500	chrome.exe	99
PID 4500 wrote to memory of 2116	4500	chrome.exe	99
PID 4500 wrote to memory of 3416	4500	chrome.exe	100
PID 4056 wrote to memory of 2104	4056	grAH.exe	104
PID 2104 wrote to memory of 440	2104	cmd.exe	106
PID 2104 wrote to memory of 2680	2104	cmd.exe	107
PID 2104 wrote to memory of 1464	2104	cmd.exe	108
PID 2104 wrote to memory of 2464	2104	cmd.exe	109
PID 1464 wrote to memory of 3212	1464	grAH.exe	110
PID 1464 wrote to memory of 2612	1464	grAH.exe	112
PID 4500 wrote to memory of 2712	4500	chrome.exe	116
PID 4500 wrote to memory of 1204	4500	chrome.exe	117
PID 4500 wrote to memory of 1204	4500	chrome.exe	117
PID 4500 wrote to memory of 1980	4500	chrome.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"
1⤵
PID:4368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffbef8ec728,0x7ffbef8ec734,0x7ffbef8ec740
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,18051385463078239304,9882515306766136009,262144 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,10900386490729628520,11407277332021289404,524288 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:11
  2⤵
  - System Time Discovery
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,3078260964717392878,2612053300384081086,524288 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2408 /prefetch:13
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,17932678194306119285,4283011761236972151,2097152 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3332,i,5828716118869134907,12105367456489136321,2097152 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4152,i,10540270928236126076,1230071107659290766,2097152 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4332 /prefetch:9
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,17951564591205527950,9521475127247818161,2097152 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,3115599860690606366,6205015410108453107,524288 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5988,i,17294190014861634849,14240654305703388809,2097152 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4776,i,15356342094000097880,6483855448278819066,2097152 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3496,i,4128253937886531977,5749894700136799660,2097152 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3960,i,4138515634830620530,12850038488023958260,524288 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4820 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3240,i,1538647663339599043,4159183212476935401,524288 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,13498533795244097606,5687553056758724700,524288 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,8038116726967550685,502634055294926942,524288 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4848 /prefetch:12
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,13641640864615202162,9373134344771689036,524288 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6216,i,10952792615581761439,676256833368438407,262144 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1196 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6208,i,4869961490727390760,3499755342197205646,524288 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6524,i,7108706455609529334,155161233655352628,524288 --field-trial-handle=1984,i,6569181176692970641,1532430152396531504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6572 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3996

C:\Users\Admin\Downloads\grAH.exe
"C:\Users\Admin\Downloads\grAH.exe"
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_ATLE11vO4gfwoAnGmnuX6RNq1n565N.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:440
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2680
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\grAH.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\grAH.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\grAH.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3212
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "grAH" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\grAH.exe\"" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2612
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2464

C:\Users\Admin\AppData\Roaming\PlatformRuntime\grAH.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\grAH.exe"
1⤵
- Executes dropped EXE
PID:2448

C:\Users\Admin\Downloads\grAH.exe
"C:\Users\Admin\Downloads\grAH.exe"
1⤵
- Executes dropped EXE
PID:2252

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000470 0x00000000000004C8
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 447f5d6205e993b90eb49033997689439bac5f0b57f95f4c46f8f757880fa552
MD5 cff25543fa41e0fdf5ff6e97b8d13b0d
SHA1 0ed66fbcaef079491412958895b7fa6da3555803
SHA512 4b061eacc8aa553c8faaf707b259eb3cbc8d9c89e41dad5156d01dffed829d2b08985ed7c2b4f39c51efd299ca88673365a68262d19dbb9d19432513eedd2810
TLSH
T144F0F4B6C921EC7B28FD0B1860644B4AE74013572781899B3A3D920CCFB1A3B499585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 d53bb3970c258b67e86efa988b575d7c505b3e968cd5957bea24f678803f3046
MD5 939318b5e29b0e7fe0c07844159202de
SHA1 679e36bff7f59b6fd59be545b7b4274dc8d85969
SHA512 a46b49d664fbcaffb6ddca2ec6a9ad6bb351d4bd26fae018d1cc2f6f42f809dea3c4e43cfb20d9fb055e32d282ac353edf884ccd434711fbcdb442fa2e3b5f31
TLSH
T1E1E05EB075D11400DF880DB624944F53672244E5CC243B0783C44834F8D3AE09602077
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 d3240d905ac3cee9ca7f0d8296a15c197d6fc8f64d9488f77c4bf02bb7633f7f
MD5 21c52252bb12445ea8ed587664907ac6
SHA1 b23fcee9c894c7526633d2308f66be0c894cdcbc
SHA512 d2fa93276530c69952ad1a4b9685022571f0b6e0b786c6192e6fb54e3cd4379c2060b9da71074c42889574fa8b144e358553184855700b963f3c2b1da85e0f94
TLSH
T1FDE0C2F032E10100DF854CB610C89F53372245DEC82A7F0393C45575D2D3ED0960013B
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 feb89cf96949e054041b5b4c913b7e3a10bb3c590a241e6bda25586923e0199a
MD5 015beeb4374c94550c5bf6dab1adc384
SHA1 a666edcaf5502baab50c3a27f66fa98c554d1dcc
SHA512 0cd9c81b82d86217b5e36c07d1f0692601659219f48534e9290c2fc04495eb8867847ae1fa623f224a813367918f63d6aa165edf52ed0b7775fafe622d9457cf
SSDEEP 48:YALlhcqDqaq+hSOCafPgycCs7DRsdXLsefoKsy4s9osNfsnKsICcpgCcgsBCrzsO:DO+RfDLkDKr599CeTyTZNwcrimK
TLSH
T1F2A1CBF3D3E8C66DC91192F0AB246F2FCE290919432D3C5688D8AF4B53E2572D20168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8107bf7da47cfb0e222ee0a86e2d17da363d03a6cad47eb94a1b929c6cc40df5
MD5 77d70dd42232b6d1e15674c4eb67ddc5
SHA1 1e723aa09ae4d72d763ebdc9dc084601864d6d6e
SHA512 2338c48c5416b36aef5685e05c4563f8888ab236b1a59aaadaf0bff5c7b7f3efab62004d32e167bc4458ef7156dbff12bb6ebc29cbd07b447bfb9d847130bd6b
SSDEEP 48:YALlhcqDqaq+hSOCafPgycPqDs7DRsdXLsefoKsy4s9osNfsnKsICcpgCcgsBCrs:DO+RfDLyhDKr599CeTyTZ/cruewd
TLSH
T187A1BBF7D3E8C66DC51162F0AB246E2FDE290A19432D3C5688D8AF4B53E2572D20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 dc144fdb247535715f42fe5a4ac1a061343206cbc64f4002dcf33d0daacca946
MD5 2e1b78932e10e9ec654dfe0cfd3115b8
SHA1 ea77d93768cde08eb5b10d1f9a093d7ea6a1a02d
SHA512 1ac2fb6a1d3efc497067e78badeb47b2b55620e0782dceb86c9528a5f48f3bb8e4045b539bb01510a5e12399a4c26e766b663cd7b896f655757289f5984f10f5
SSDEEP 48:YALlhcqDqaq+hSOCafCs7DRsdXLsefoKsvfgmzsy4s9osNfsnKsICcpgCc1CCsPf:DO+RfDBDKr8B99CeTyT1IYK
TLSH
T1A4919AF7D3E8866DC91192F4AA106F2FDE290D59432D3C26C8D8AE4B53E2572D21168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c74010c8b55622b168f4e665a987d21127d910b7e1550fb3cb53319a730cf1f4
MD5 2886071dcb40272c121753f57f75ee48
SHA1 e5f8ee6b021bbfc35aa0b78f346c1f307b834b79
SHA512 f204e4f767330d83bf6b0af46325c0bb97e07a41c983428e6ed85139e634988005daa5e112ffcf1346e9370fd03ea2f304fbd422cdbf21b73e4e28a855af55e0
SSDEEP 192:sR7lWQsg5waPv7lpAPRp2O9+Hsb+WNnsb0dJeByVyIsnAUgtaJ:sR7llssHRUXB0wQ0/8
TLSH
T17042B57EED20697B6CCBC229FA657753D7F5102121D42E84EAFC9A2C14DB9CC221B05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 14a1db0d8ae274f8fa0e1771af35c89c2c2aa015b403c8b76a814d7b0d90ae22
MD5 74668b47b957ccab84b56a96683f1477
SHA1 3e22abb644095ff4d0fb4d8c2e9649159bec9e82
SHA512 b8acb87b828fb091ba6a51f1da14b26760a38a150a2b801143faa4f5aca111c7a238821d635ad0b1e3bd4138108965ea3e19d6d30b8ebf7ac670849a714c7208
SSDEEP 192:sR7lWQsg5w6Cv7lhAPRp2qlzW9+Hsb+WNrrsb9P023JeBzVyIsnAUgraJ:sR7llssOR8XS0wwq2We
TLSH
T10952C7BEF92069BB6CDBC219FA157757E7F5102161C02E84EAFD9A2C14DB9CC220705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f98a5f4b8f78d0c135580d52defa73bde53457dc4fb338fffd965c5d464bfd17
MD5 25e7bc20dfba9d4fd1de4ecdabef1ca6
SHA1 1b2e732d0498e0b3118db5fb51652cd3984f451d
SHA512 aed6a5ecc93a70f496bd164b90707a442c60f0246564d9620ee731568adb5d06ef559f80c4b41e660137fba1552a93f4a218d4e6dbe233ccf77ffd0e61a97920
SSDEEP 192:sR7lWQsg5w6Pv7lhAPRp2qlzW9+Hsb+WNrrsb9P02AJeByVyIsnAUgtaJ:sR7llssHR8XS0wwq2y8
TLSH
T17F42C66EED2069BB5CDBC229FA257757D7F5102121C02E84EAFD9A2C14DB9CC220704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 61945f141d0bec526ea4c74fb463171871b99876a5f39e416f4f4dae8a09ef98
MD5 cc680677e5cb24d8cc2041ac9456cbbb
SHA1 13f3adefb9e4f34672826c7855d0e8d905127cd1
SHA512 0b54db5023bc14bdcfb7d1141dfb565921d772de7f02ba5679b1b20c2e1ee0a45c2ae05d3f764e2dd7c051df37c10eca714456491c6e69663d0afb10f970fdbd
SSDEEP 192:sR7tWQsg5w6Pv7lhQPRpkqlzW9+Hsb+WNrrsb9P0Dud8eJeBP8yIsnAUgraJ:sR7tlssHRkXQ0wwqs8ee
TLSH
T14852D9AEF91069BB5CDBC229FA157757E7F5202125D02F84EAFD8A2C14DB9CC220705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6853a75d5d06b8ed22f00f48bcba47a6f5aa753292b6c3ad9f71f3db3d76b91c
MD5 8e317be330b97facaf78aca0fab46816
SHA1 6226d5d7d5bd98cd2d5cb5c99fff137a17e92910
SHA512 1df79cb22082b5cf760424a01dcc94d2f51b361f0d35a333375bea81589498c1d02055f1d7c6a717df8a4dfb7fb89b52457a1543e5874456fa67d3019a755bca
SSDEEP 192:sR7lWQsg5w6iv7lhAPRp2qlzW9+Hsb+WNrrsb9P0Dhe2ZJeBz8yIsnAUgraJ:sR7llssuR8XS0wwq823e
TLSH
T12A52C6AEFD2069BB5CDBC219FA657757E7F5102121C02E84EAFD9A2C14DB9CC220705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f0c822976367c7c315f96d21e9e50a1ea8685875c9480079c23153ea63b9d5e4
MD5 23299b802ba7f843910a2a34e56bf7a5
SHA1 72a7a96c28a7f9b1dca1cb324b23bdb5bb98be45
SHA512 131612f310faec722d628d052cb696799c6d8c3adf5bb7e33e97220282e3c11dddd6572f6d0a854bb37ad83575539bce39b636fb5f7171b34cc7af7e0d663f7c
SSDEEP 192:sR7tWQsg5w6Hv7lhQPRpkqlzW9+Hsb+WNrrsb9P0DMdWwJeBP8yIsnAUgraJ:sR7tlssPRkXQ0wwqEWEe
TLSH
T1DC52D8AEF91069BB5CDBC229FA557757E7F5102121D01F84EAFD8A2C14DBACC220705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 a1fc9cc0e5de9c3854166a6ca33135e58e0e11732323016e44f493bdfd7f8061
MD5 75961d8b390d71762393495cd62294ad
SHA1 4427ff9cc738d9dc20e454fc7879f02497afa082
SHA512 d62649bc7f5e5c03df68d101855793542a238e1407c476f46fbef7b734a46efc95638009194efe39a28865bd2f06c21477ebde568608dd350aa14fcf9aab182b
TLSH
T1DCC01295C802E131C04A03F1658698DCF1545F21E65E374883F43AB6E83C122C11B261
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f5b36ce826dba628e2a017f32b1812b3052f541d557c8e0aba3f191a3a48fece
MD5 475a9dce81eaae4f9888678e33e48492
SHA1 71bd76eaf970a1f9465bbdb2510fe2b032d034fb
SHA512 436487e6757a4576ef3cb574041e9195484b52167beb2f91df9848250384cee470d1d6b782f455d5c23b265a717ffc378532f4df70ef8aa67f3f0198fdeef427
TLSH
T12FB0124080015201C44306F01143148873545F60DE0A1B0193E06B32C8291618494062
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58991e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58991e.TMP
Size 96B
SHA256 569589e143f81fb6fbbba790467e967e9bf3705a42a5e6b7856e2fa3c17d75b9
MD5 316372f8e817bdb71d875d947e4ddf17
SHA1 fcc4691aa98fe752bc6b73a25d4e6365bf55b358
SHA512 8621cfe67cc0da69767432e07847431a06b64d627a4184e9c22ca36c6ee9a9023522fcd5525bc5863ebacfdc6afbf76850e2a1ea0e45cc50226d47e84d230128
TLSH
T1C8B02200C202A202C00303F030C088CC3320EF30C303220282E00A2ECC28A308AE8230
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a462e49035d367c947d2cb4fc667008b4369c20dfc61d05456abaee78d9e4eff
MD5 6e61306db343a8eb40b43450abb55741
SHA1 388f1c61a56f6376e241b562738059aa75359794
SHA512 565a1d3b1a362fbdaa40374822fe2e0370f5f898c90c191897d61f9c8f2e7a87f8836548dbf66f64553bf9a6dcd2afdaaaa649eb37e3a8edaa44b8ad42201751
SSDEEP 3072:yGm7D5Lk17ox1tIpud63U8BehbCBi9fTrML:Fm7Rkm1tYpBeh2BAoL
TLSH
T166C312375D74E97759B9BB5EB08E0B1F1EF149A3C920DE92C8D85B0423EA6CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 f9d343980c84195115b05c3707fd6d0b060e1d1dcb2828b1d9b73654e325e1df
MD5 9e3a921965a3a3ed9c2986c497929ce1
SHA1 024fa444c6b472cb69c7babe751ce12e09ce869f
SHA512 909175195ed67906c710ebf692bace3e77614bfb4580dc6b59054b895d26ec85202314cf94d576ed83df4af095d36e83b5aed8e9e63cfb48a2a1b6ff4f48666c
SSDEEP 6144:aPKUREk2LuA40Cxs/m7Rkm1tYpBeh2BAo9:aPKUj26A2sO9oBGcAo9
TLSH
T11D3412139D6CA97718BCA35F708F272E1BF04D07A516FB1989C8DA0413EE78C5649EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 de4c899fa1f4df6f0216048ad29bde4d620330e71cfc7cc52362211de57877b1
MD5 af54076f28fb4705fad360b5d911f858
SHA1 a76ec0f7af18a75cf902cbd5f35a1c0d6cc29799
SHA512 06ccc4df90dd456bc4d29e054e6e33d2e7a318717e24b0cb91360e43ea1050513d2aafdcb54885c9806d5f1b4623d9ac5576acded1caa5fa22ad32fbaa651e0b
SSDEEP 6144:khPKUREk2LuA40Cxs/m7Rkm1tYpBeh2BAo9:CPKUj26A2sO9oBGcAo9
TLSH
T1963412339C6C99B618BD635E304E3B1E1EF04D4BA916FB1989C8DB04139E7CC5649EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 855462d80b3ce12e2534bdbc4a406e3f2ffff0d1f0c8179f2cf8f7bf7844335b
MD5 77fb26f5a7e0f2f3bf421e40121ed09b
SHA1 28c775c293df96daa12bc7fcbfa21d09fa0cac57
SHA512 adc837f4cda8d41e0670540228b63a3a35ff537f57b7b4a6c23e4e57a83f3944836664bf70c2dfd7d8e41dd4bac4cfd067dedda52413c8437ead89d72cf42841
SSDEEP 3072:wGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:7m7Rkm1tYpBeh2BAoa
TLSH
T195C312379E71A97B5979BB4EB08E0B1F1EF149A2D920DE82C8D85B0437F97CD0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 d2605fdbf84c8aa913f7689076d5998e645efb4c292e4fd12c813861840ec39c
MD5 8429a8a51e83b753d9b78a8026bd0781
SHA1 cbff4eeeb3b639dd234c0f1921240b0875fb9627
SHA512 fc6da07a258fe158bc4e834e0aa3ad50352f227e5a13887a414436b80816661fbdae090d7566e9cfb3060ce2521fff6ac66684a5f8c326580aff6530f356daa9
SSDEEP 6144:ohPKUREk2LuA40Cxs/m7Rkm1tYpBeh2BAo9:uPKUj26A2sO9oBGcAo9
TLSH
T1E93413339C6C99B618BD635E304E3B1E1EF04D4BA916FB1989C8DB04139E7CC5649EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

grAH.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\grAH.exe.log
Size 859B
SHA256 a6f7d3892a001df1aafe2eaf221a3b09a4fdad23ad642a62b9cc50fd25f9415f
MD5 b80ab36515c0740685e38a5cd01e292a
SHA1 ebea40ce14021888f2c869576ad62b98b7c73c8a
SHA512 a9ad31c000c2264f8a9b7bac6bc60edd7ecf0d1c946a4bb3e57d824283c6b65e59344e834bcbf563586211078ddb895af13e4c697bea2c4a907982bbc5fbd4a0
TLSH
T1CE1166313376A0D889163F821C1E56C957BF4329A550AD08B998624DED3601B6B213E3
MD5 SHA1 SHA512 TLSH

Submit Download

aforge.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.dll
Size 17KB
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.directshow.dll
Size 60KB
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.dll
Size 20KB
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

costura.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\costura.dll
Size 5KB
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.win32.registry.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\microsoft.win32.registry.dll
Size 22KB
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.asio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.asio.dll
Size 33KB
SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
MD5 01a76191d31b3d6042484e452bd66ce0
SHA1 c84ecf4875c17d9cc91c911feabca640c7ffc661
SHA512 09fa738e43b1a4272a9e16045bcc0fd00858f4367d41b1f9fe3cf97589379b5fcd1fcbd1a24bca74a08187f080941cb575332d3725f620f93fd0b414dea0a9bd
SSDEEP 768:EehRrWpB5henH0HTYdpVCYKo9coe6ttHjBR/:EehRr68U47QGtHFx
TLSH
T10BF22B71EBD84A27C92E2779A0F2040407B5F191F623EB4F9A4C94A96FE73594790373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.core.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.core.dll
Size 183KB
SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
MD5 4e4302ce791e48f985a3a221a19a272b
SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
TLSH
T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.dll
Size 7KB
SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 e90ac3063409ef6876e26422dc61d0eb
SHA1 3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SHA512 a04dc95e234652c8f4a8ddec88ee3ebd87e68d826eac008625f994323e569d3a3026c7cd7ce2d790ae2ac3018fadf10e600e7ba13cab9bbcc49192263a32fe6a
SSDEEP 96:QDBFskeJHnqvjZkcLqED5Iyr2T7AVUhkon1MrtrRGc5pkQrESd2uYO:QD7kHnqNkcLWyr2T7zSon1MRlwQoStY
TLSH
T1FDF1D724A398CA77CE6347B1A86706401379FA80A917CB2E0D8CA18FBD537594BB27D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.midi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.midi.dll
Size 45KB
SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 f6940019dad6c782bcb645c2f7d52db5
SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
TLSH
T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winforms.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winforms.dll
Size 33KB
SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 115137414b41a26d6e73738cd94c036c
SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
TLSH
T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winmm.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winmm.dll
Size 56KB
SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 c1b78af3d6402be8f259dbbe9250e7fb
SHA1 98e2c38597c50390852801d46ff342889c7351ae
SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
TLSH
T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.memory.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.numerics.vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.numerics.vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.resources.extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.resources.extensions.dll
Size 78KB
SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
MD5 058062075dae2f0db660018d899358da
SHA1 4489f30223d4f80ad7c220615be2047afa82f085
SHA512 d2a568d19a0dfe06f9d9916c335fa1d752ed7ca78844124079e41b34c2342cbe3486f1d77a68c6cdd576d30fe84d03b12a7c7a5aabd09ee98174b0a167af01c7
SSDEEP 1536:PElSh0fXNlYQRZLj2O5xEMXfy6lNQYjLTb+G8uNsHQEispJnuFvTbp6wy/ei+zq9:PlLQCpuh6wMs+9
TLSH
T12973B51173FC5319F6FB2FB865F151118A3ABDA2A931D62D198160DE1AB2BC08D70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.runtime.compilerservices.unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.runtime.compilerservices.unsafe.dll
Size 16KB
SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
MD5 b78649f583f2b905c1cbf79ab90cc108
SHA1 847ec2fefaddbd2420e20065193497fa1ef2b489
SHA512 e9e99c5e60388956ac7cc8c2ae963364ad74a89432c5fae514648a68e24c13a684577313056ac9b6a264729f5c99de68bc809c14482d4f9dd12835f3cd13522d
SSDEEP 192:9Y4tIhywFXXbxfxdPWg9hWMW65FdQHnhWgN7aJeWPLyFqnajRRuvp7:9Y8ItFXXb/dPWg9hWOQHRN7WrolVRuvF
TLSH
T178723B999BA81103EE631F3096A5C943FE3CB3D61902D31D3985F7785C9E7D4AE20638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.accesscontrol.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.accesscontrol.dll
Size 30KB
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.principal.windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.principal.windows.dll
Size 14KB
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_q0y01ccv.xf4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q0y01ccv.xf4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cleanup_ATLE11vO4gfwoAnGmnuX6RNq1n565N.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_ATLE11vO4gfwoAnGmnuX6RNq1n565N.bat
Size 491B
SHA256 e75004316439d9492c53fd9e325c3ba535733e423be915d8d648505426ef2c4c
MD5 6421022a8c220c04e5d34cd9117ee360
SHA1 d72b7314804dc9ba03ccc7a7782192c1d2a3c70a
SHA512 3806c0f36a84d1970a784e9ee79c3c6ee639c6f506e524f10c8931b829e2b1f81ba3620bedc22b686d300503dc7100914ae38e2cbe4d92d6c2fd8bc2d1c0a6ae
TLSH
T1A3F0275723CE870E2420957B0EBE32C9C0EE90637E5070823B64C81797A643B89D7AE3
MD5 SHA1 SHA512 TLSH

Submit Download

grAH.exe

Path C:\Users\Admin\Downloads\grAH.exe
Size 2.8MB
SHA256 1206a35fd064858d84c15fb945efa63ba2913766c81860005f1933a9a04be7ce
MD5 dcecde9b6911fe2ee6c8295b82e7432e
SHA1 277581c9e3447d01991c65f1328f622978792d8f
SHA512 6709dbf27bc1b15462daa870b045760c21f85ed83648813039de6d00822dae30d8f020c30356573dd8b66723ff00dfd7668457ce79e98506a71716de1fe4754e
SSDEEP 49152:6gVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw446Wp:6gVUuHjkDGjzqpgmwQ1GuRxzew
TLSH
T1B9D5021C33FACB18F2AF4BB4E87185664371FD179D62D76C58A1399E04B6F48AA10B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

grAH.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\grAH.exe:Zone.Identifier
Size 52B
SHA256 161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67
MD5 dfcb8dc1e74a5f6f8845bcdf1e3dee6c
SHA1 ba515dc430c8634db4900a72e99d76135145d154
SHA512 c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d
TLSH
T1A190025B044444440A9571C495DC9658A41F79994D4512C4EC8044D69D840AC51E452A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1464-657-0x0000016D51950000-0x0000016D5195A000-memory.dmp

Download

memory/1464-656-0x0000016D519B0000-0x0000016D51A64000-memory.dmp

Download

memory/1464-663-0x0000016D51980000-0x0000016D5198E000-memory.dmp

Download

memory/1464-664-0x0000016D51B30000-0x0000016D51B64000-memory.dmp

Download

memory/1464-665-0x0000016D51AF0000-0x0000016D51B04000-memory.dmp

Download

memory/1464-662-0x0000016D51990000-0x0000016D519A6000-memory.dmp

Download

memory/1464-659-0x0000016D51A70000-0x0000016D51A8A000-memory.dmp

Download

memory/1464-658-0x0000016D51AB0000-0x0000016D51AE2000-memory.dmp

Download

memory/3212-598-0x000001DAA0D10000-0x000001DAA0D18000-memory.dmp

Download

memory/3212-593-0x000001DAA0B00000-0x000001DAA0BB3000-memory.dmp

Download

memory/3212-592-0x000001DAA0AB0000-0x000001DAA0ACC000-memory.dmp

Download

memory/3212-579-0x000001DAA0820000-0x000001DAA0842000-memory.dmp

Download

memory/3212-600-0x000001DAA0D70000-0x000001DAA0D7A000-memory.dmp

Download

memory/3212-599-0x000001DAA0D20000-0x000001DAA0D26000-memory.dmp

Download

memory/3212-594-0x000001DAA0AD0000-0x000001DAA0ADA000-memory.dmp

Download

memory/3212-597-0x000001DAA0D50000-0x000001DAA0D6A000-memory.dmp

Download

memory/3212-596-0x000001DAA0AE0000-0x000001DAA0AEA000-memory.dmp

Download

memory/3212-595-0x000001DAA0D30000-0x000001DAA0D4C000-memory.dmp

Download

memory/4056-500-0x00000218176D0000-0x00000218179A6000-memory.dmp

Download

memory/4056-544-0x00000218320F0000-0x00000218320FA000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads