hijackloader | 070f20fe5060d8380699d2a6ccdc4a4016f0c6b6b5a2ab04d17415aa8e48de61

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/06/2026, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kythy.exe
Size 9.3MB
Sample260613-3ncxjsav2t
SHA256 070f20fe5060d8380699d2a6ccdc4a4016f0c6b6b5a2ab04d17415aa8e48de61
MD5 85a189ae594748585f7a3c91599b25af
SHA1 5531918b7f412281f02c64d6e203cc28b0cbc796
SHA512 14a02d5a1c727083cd392ee3051b97e6f5df720dc57356f53a75358a406dd554caae22ea4fd818812f2f969648766c8fd017e7d089454e936bff6aa2bf20ebeb
SSDEEP 196608:+p0STjebTiPifVuHEkIiNFa/h/TF2y4E34UCywVD4Lcln+ZmUJxA:+pjKbTL6BFa/mO34UEVDvn+ZmUfA
TLSH
T1EDA6335377CD0AF3C6B0053E6F24E393043AD65E92C45E8BD69E4EA53CC91E8821B9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\TaskCache_arm
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x002000000002b252-35.dat	family_hijackloader
behavioral2/files/0x001900000002b430-82.dat	family_hijackloader

Suspicious use of NtCreateProcessExOtherParentProcess 26 IoCs

description	pid	Process	procid_target
PID 2308 created 5512	2308	GridAna.exe	90
PID 2308 created 5516	2308	GridAna.exe	91
PID 2308 created 5844	2308	GridAna.exe	94
PID 2308 created 6068	2308	GridAna.exe	95
PID 2308 created 2380	2308	GridAna.exe	96
PID 2308 created 3388	2308	GridAna.exe	97
PID 2308 created 5600	2308	GridAna.exe	98
PID 2308 created 4392	2308	GridAna.exe	99
PID 2308 created 6036	2308	GridAna.exe	100
PID 2308 created 5512	2308	GridAna.exe	90
PID 2308 created 5512	2308	GridAna.exe	90
PID 2308 created 5844	2308	GridAna.exe	94
PID 2308 created 5844	2308	GridAna.exe	94
PID 2308 created 5528	2308	GridAna.exe	108
PID 2308 created 5948	2308	GridAna.exe	109
PID 2308 created 3124	2308	GridAna.exe	110
PID 2308 created 2976	2308	GridAna.exe	111
PID 2308 created 5756	2308	GridAna.exe	112
PID 2308 created 3244	2308	GridAna.exe	114
PID 2308 created 4712	2308	GridAna.exe	117
PID 2308 created 5140	2308	GridAna.exe	118
PID 2308 created 4624	2308	GridAna.exe	119
PID 2308 created 5528	2308	GridAna.exe	108
PID 2308 created 5528	2308	GridAna.exe	108
PID 2308 created 3124	2308	GridAna.exe	110
PID 2308 created 3124	2308	GridAna.exe	110

Executes dropped EXE 3 IoCs

pid	Process
3204	DecAlpha64.exe
2608	DecAlpha64.exe
1176	DecAlpha64.exe

Loads dropped DLL 7 IoCs

pid	Process
3204	DecAlpha64.exe
2608	DecAlpha64.exe
1176	DecAlpha64.exe
4348	PAggregator.exe
2308	GridAna.exe
4276	Crisp.exe
1676	Crisp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\desktop.ini	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	PAggregator.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2043432456-1617298091-2772621413-1000\desktop.ini	PAggregator.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2308	GridAna.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 1176 set thread context of 4348	1176	DecAlpha64.exe	83
PID 2608 set thread context of 2308	2608	DecAlpha64.exe	84
PID 1176 set thread context of 4276	1176	DecAlpha64.exe	85
PID 2608 set thread context of 1676	2608	DecAlpha64.exe	86
PID 4348 set thread context of 5512	4348	PAggregator.exe	90
PID 4348 set thread context of 5292	4348	PAggregator.exe	106
PID 4348 set thread context of 5512	4348	PAggregator.exe	90
PID 4348 set thread context of 2836	4348	PAggregator.exe	136

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sl_FEMININE.pak	PAggregator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\SWBELL.NET.XML	PAggregator.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll	PAggregator.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui	PAggregator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md	PAggregator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll	PAggregator.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\mr_NEUTER.pak	PAggregator.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml	PAggregator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll	PAggregator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png	PAggregator.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml	PAggregator.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\vi_FEMININE.pak	PAggregator.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	PAggregator.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll	PAggregator.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\UIAutomationProvider.resources.dll	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\OOFTMPL.CFG	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png	PAggregator.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json	PAggregator.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll	PAggregator.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Primitives.resources.dll	PAggregator.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll	PAggregator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	PAggregator.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REMOTEL.ICO	PAggregator.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll	PAggregator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll	PAggregator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll	PAggregator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll	PAggregator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties	PAggregator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui	PAggregator.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.contrast-white_scale-80.png	PAggregator.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml	PAggregator.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll	PAggregator.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Extensions.dll	PAggregator.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\WindowsFormsIntegration.resources.dll	PAggregator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif	PAggregator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms	PAggregator.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms	PAggregator.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Tasks\StorageCrypto_v1_0.job	Crisp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DecAlpha64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DecAlpha64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DecAlpha64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PAggregator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kythy.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5844	chrome.exe
3124	msedge.exe
2200	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GridAna.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GridAna.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134258675980290405"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4348	PAggregator.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3204	DecAlpha64.exe
2608	DecAlpha64.exe
2608	DecAlpha64.exe
1176	DecAlpha64.exe
1176	DecAlpha64.exe
1176	DecAlpha64.exe
1176	DecAlpha64.exe
2608	DecAlpha64.exe
2608	DecAlpha64.exe
4348	PAggregator.exe
4348	PAggregator.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
4276	Crisp.exe
4276	Crisp.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
5512	chrome.exe
5512	chrome.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
1676	Crisp.exe
1676	Crisp.exe
1676	Crisp.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
4348	PAggregator.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe
2308	GridAna.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4348	PAggregator.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1176	DecAlpha64.exe
2608	DecAlpha64.exe
1176	DecAlpha64.exe
2608	DecAlpha64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	PAggregator.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeDebugPrivilege	2308	GridAna.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeDebugPrivilege	4348	PAggregator.exe
Token: SeDebugPrivilege	4348	PAggregator.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5528	msedge.exe
5528	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3204	3516	kythy.exe	80
PID 3204 wrote to memory of 2608	3204	DecAlpha64.exe	81
PID 2608 wrote to memory of 1176	2608	DecAlpha64.exe	82
PID 1176 wrote to memory of 4348	1176	DecAlpha64.exe	83
PID 1176 wrote to memory of 4348	1176	DecAlpha64.exe	83
PID 2608 wrote to memory of 2308	2608	DecAlpha64.exe	84
PID 2608 wrote to memory of 2308	2608	DecAlpha64.exe	84
PID 1176 wrote to memory of 4276	1176	DecAlpha64.exe	85
PID 2608 wrote to memory of 1676	2608	DecAlpha64.exe	86
PID 1176 wrote to memory of 4276	1176	DecAlpha64.exe	85
PID 5512 wrote to memory of 5516	5512	chrome.exe	91
PID 2608 wrote to memory of 1676	2608	DecAlpha64.exe	86
PID 5512 wrote to memory of 5844	5512	chrome.exe	94
PID 5512 wrote to memory of 6068	5512	chrome.exe	95
PID 5512 wrote to memory of 6068	5512	chrome.exe	95
PID 5512 wrote to memory of 2380	5512	chrome.exe	96
PID 5512 wrote to memory of 3388	5512	chrome.exe	97
PID 5512 wrote to memory of 5600	5512	chrome.exe	98
PID 5512 wrote to memory of 2380	5512	chrome.exe	96
PID 5512 wrote to memory of 4392	5512	chrome.exe	99
PID 5512 wrote to memory of 3388	5512	chrome.exe	97
PID 5512 wrote to memory of 5600	5512	chrome.exe	98
PID 5512 wrote to memory of 4392	5512	chrome.exe	99
PID 5512 wrote to memory of 6036	5512	chrome.exe	100
PID 5512 wrote to memory of 6036	5512	chrome.exe	100
PID 5512 wrote to memory of 3620	5512	chrome.exe	101
PID 5512 wrote to memory of 3620	5512	chrome.exe	101
PID 5512 wrote to memory of 2920	5512	chrome.exe	102
PID 5512 wrote to memory of 2920	5512	chrome.exe	102
PID 5512 wrote to memory of 4864	5512	chrome.exe	103
PID 4348 wrote to memory of 5512	4348	PAggregator.exe	90
PID 4348 wrote to memory of 5512	4348	PAggregator.exe	90
PID 4348 wrote to memory of 5512	4348	PAggregator.exe	90
PID 4348 wrote to memory of 5512	4348	PAggregator.exe	90
PID 4348 wrote to memory of 5512	4348	PAggregator.exe	90
PID 4348 wrote to memory of 5292	4348	PAggregator.exe	106
PID 4348 wrote to memory of 5292	4348	PAggregator.exe	106
PID 4348 wrote to memory of 5292	4348	PAggregator.exe	106
PID 4348 wrote to memory of 5292	4348	PAggregator.exe	106
PID 4348 wrote to memory of 5292	4348	PAggregator.exe	106
PID 4348 wrote to memory of 5292	4348	PAggregator.exe	106
PID 2308 wrote to memory of 5528	2308	GridAna.exe	108
PID 5528 wrote to memory of 5948	5528	msedge.exe	109
PID 5528 wrote to memory of 3124	5528	msedge.exe	110
PID 5528 wrote to memory of 5756	5528	msedge.exe	112
PID 5528 wrote to memory of 5756	5528	msedge.exe	112
PID 5528 wrote to memory of 2976	5528	msedge.exe	111
PID 5528 wrote to memory of 2976	5528	msedge.exe	111
PID 5528 wrote to memory of 2976	5528	msedge.exe	111
PID 5528 wrote to memory of 3244	5528	msedge.exe	114
PID 5528 wrote to memory of 3244	5528	msedge.exe	114
PID 5528 wrote to memory of 3244	5528	msedge.exe	114
PID 5528 wrote to memory of 2936	5528	msedge.exe	113
PID 5528 wrote to memory of 2936	5528	msedge.exe	113
PID 5528 wrote to memory of 2936	5528	msedge.exe	113
PID 5528 wrote to memory of 2168	5528	msedge.exe	116
PID 5528 wrote to memory of 2168	5528	msedge.exe	116
PID 5528 wrote to memory of 2168	5528	msedge.exe	116
PID 5528 wrote to memory of 4712	5528	msedge.exe	117
PID 5528 wrote to memory of 4712	5528	msedge.exe	117
PID 5528 wrote to memory of 4712	5528	msedge.exe	117
PID 5528 wrote to memory of 4624	5528	msedge.exe	119
PID 5528 wrote to memory of 4624	5528	msedge.exe	119
PID 5528 wrote to memory of 4624	5528	msedge.exe	119

C:\Users\Admin\AppData\Local\Temp\kythy.exe
"C:\Users\Admin\AppData\Local\Temp\kythy.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Users\Admin\AppData\Local\Temp\DecAlpha64.exe
  "C:\Users\Admin\AppData\Local\Temp\DecAlpha64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\ProgramData\TaskCache_arm\DecAlpha64.exe
    C:\ProgramData\TaskCache_arm\DecAlpha64.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\AppData\Roaming\TaskCache_arm\LWBMYGVBVHWOPMLLW\DecAlpha64.exe
      C:\Users\Admin\AppData\Roaming\TaskCache_arm\LWBMYGVBVHWOPMLLW\DecAlpha64.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Users\Admin\AppData\Local\PAggregator.exe
        
        C:\Users\Admin\AppData\Local\PAggregator.exe
        5⤵
        Loads dropped DLL
        Drops desktop.ini file(s)
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4348
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:5292
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Roaming\toolhost_v5\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\toolhost_v5\Crisp.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4276
  - - C:\ProgramData\GridAna.exe
      C:\ProgramData\GridAna.exe
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ff96c25c188,0x7ff96c25c194,0x7ff96c25c1a0
        6⤵
        
        PID:5948
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,1433511262678665129,3647236266499000375,524288 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:3124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1696,i,929059479670938745,3661457208206915189,262144 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
        6⤵
        
        PID:2976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,7876895930791798969,1320188722380311463,524288 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:13
        6⤵
        
        PID:5756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2366751627130466616,7755934938808030355,2097152 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
        6⤵
        
        PID:2936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,8162935782007617180,1056883513351424463,2097152 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        6⤵
        
        PID:3244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4044,i,8747474340053436552,2587440837268442663,2097152 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
        6⤵
        
        PID:2168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4068,i,3620204095798072481,7251381835448445934,2097152 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:9
        6⤵
        
        PID:4712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4100,i,12141127393689122436,142164169840477774,2097152 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
        6⤵
        
        PID:5140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4108,i,571006895264584174,2547140811623919940,2097152 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:9
        6⤵
        
        PID:4624
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,14352604845066347234,3856895375332912252,524288 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
        6⤵
        
        PID:4556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,5792108438598557798,16517775798718359952,524288 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
        6⤵
        
        PID:568
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,11960202247799664984,8763275956817104341,524288 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
        6⤵
        
        PID:4340
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,18319914967175776650,14190631205292834379,524288 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
        6⤵
        
        PID:5052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,8190320198047484432,11225839225255393532,524288 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
        6⤵
        
        PID:880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1052
        7⤵
        
        PID:776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,12685264725361324035,14876574611236513978,524288 --field-trial-handle=2612,i,2444471601417892408,16323993879950217927,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
        6⤵
        
        PID:3840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        7⤵
        
        PID:1756
  - - C:\Users\Admin\AppData\Roaming\TaskCache_arm\Crisp.exe
      C:\Users\Admin\AppData\Roaming\TaskCache_arm\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:4368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff970f8c728,0x7ff970f8c734,0x7ff970f8c740
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1872,i,471174630015608143,13165855433604147219,524288 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3744 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,1054368728176360508,10429320132582180305,262144 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3716 /prefetch:2
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2608,i,6747289190574517703,5697855361201771871,2097152 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1376 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,7946804079149655520,8636335285590273924,524288 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3828 /prefetch:13
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2612,i,8602436033131923581,18149663869949820057,2097152 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3384,i,8739713207655447551,11866544714034801993,2097152 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3884 /prefetch:9
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4664,i,9701184816404750727,7121565489684724579,2097152 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2588,i,624094925539851858,5785495504936508190,524288 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:14
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4960,i,332341931736116144,6446938914169901007,524288 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,14520200030040136034,3255330231540062395,524288 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,7664659148053797317,2242202755646578811,524288 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,5865574960126341413,15013060210475498671,524288 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,15026019165439663745,16932143767370985349,524288 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1872,i,894739138855333220,13452388077803287026,524288 --field-trial-handle=3720,i,15040143569078259787,10084944938437069252,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2200

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:620

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GridAna.exe

Path C:\ProgramData\GridAna.exe
Size 358KB
SHA256 9cf9a98657671c653566fa16a9a70785f535e78343fc987b53ec3c1c17790354
MD5 73fdd2d0f52b02d85b39efd8fdd9ca25
SHA1 c231a5b6ffe52ce2e1c4a972c704cc4ec7ac40c9
SHA512 7d464a7c381df42c8cbc4dae06a664ab07837c0e85c6a53c7aa4cc2c2909d43c77f0d3e5d242ac0c18f13cb43f69628367560664bb6cf8b5f32e8937491f9914
SSDEEP 6144:RN9XlrU9y5rhHTl8LtawYkUjaP0Q1aOcS/6Kd/V9pe:RNZdXrH5HkUjaPM8V9M
TLSH
T13C749F4AF37518F9D427C138C9D3565AEA717819972153CF13A08AA63F237E0AE3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 5ce9e5417951a0bf42a095db14f3917f13c55c40165405dd6cbd209fb4d75112
MD5 77e6e4fb93436f1459f65a73caaf047b
SHA1 9af3d4125e867a9c94bd6d2adfebc2030bc81351
SHA512 592eb06502fef4ce9649dae9a5e381f97b99ae2ca94b285f1a7c0ec071abf946bbf34aea21d55d5e99195f961688486e57015d0c9db1399a53d06b7a84082682
SSDEEP 24:biXROMMBS+MkIYWIEW9tdRcJDOmSMQaeB4iihSgW0PpbW:biBO2+MKWIEotduDO1Tp5ihSgWObW
TLSH
T12825BE05FB486AABC0438570D8AF17607A74F2D61B434B8F3214E61F7E9F0884F42118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 53fd1950ce0c9b0a2b79e038026268b4b0eabf0d2f55ff12611dfc96d3671681
MD5 4501359eda6e16496457139ec888e5e6
SHA1 3fa1f2e2edba96a0d6fd3e519e4e119c9da80f70
SHA512 0a4cbaf5fe4deeb5e0e0a9346e04e524cd3fb6d4071cf541f6debc594ed86a0df8e0be51877f27ce9a79b1d9e1ccfc14fdfe8cd25f11f16da5c40010963c6b2a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 24fb1cef7765fb931052b91e75f7ae7d32adbaf16fd3b27ebb5196fdf09f6322
MD5 3ba298d59aee09d6762f6969a793e0f8
SHA1 8038081da64b4194e80e795f08ddb4d4e36d6200
SHA512 dc8dc050037c3457308067941cd2172634fc53a0418c1979d85e19e5229670a981ce5c979ef8700de070bbb257be042056dd24eaf7ef014573a2247c25112f67
TLSH
T18BE0ABA6C831EC2B09F9175C90904706E34013072F60484F3B3C810CCFB153B038185C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 322cf8d1e9f6236d3e7192eafaa1a71a21043f9b4cf7f412204e05e04953dfbc
MD5 3efa06754ad4396669978ee91bc9cd94
SHA1 dfb6069b42cd2022aad77ee130e18527f9a17ba1
SHA512 1642bedfc5671a0d34e95843a4e0fd79d10a206d35ba47b598cd636ee4a3b053365734bc5dff3c0f1748d77a057895848891f1cce1f84ffd37cec21da04df306
SSDEEP 192:fRGTy21bGrw6v7mpAPRp2n9EHsb+WNn3AdDmezfX2axlaUVyIsnAUgtaJ:fRGTZWaUXAawQdDfX2SaQ8
TLSH
T17942E72EF910697B6DDBC219FA267757D3F6102121D42E84EAFC8E2C19E75CC221705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 78f2b9e9ebc08798880cb4679beee8aef2e584a4e9691c5edb1c0165ca1273af
MD5 f3fb909317ed06709bfdddf6e293f823
SHA1 f9840b19b75e8120807aa0784c1bde6154aba029
SHA512 4bd189ef0e2f72445f5af07954ee4d6ebdcc450090a92b283a2c281a3cf530c9eff525dfd48ea12519fb7f49e455434598bbe11f388dcada8c12c9ada348e50c
SSDEEP 384:7NjnO7KxkXqKf/pUZNCgVLH2HfgslOv7pLuLcSjZkXODnq+ErU3BHHGu/n0To:7NnO7KxkXqKf/pUZNCgVLH2Hfgs8v7pU
TLSH
T18172E9A76C4C9E370F94CACCDC1A7B4FADB6024B65E9886443FA582503D5ACF114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 60e15c0a1c541c0a6139a7999e90c0174d5982ee14a7e5d2216e30046ef69123
MD5 e1962971143691694ad8d6105b695986
SHA1 5f70df7391b9654b625165e428fe22d83eaaac23
SHA512 42ca8ea41a865827a72890b956b0e62ce6687a780196c95951fb06bb841a82a99d46a82ceac69680bc3e1ea5fa0f5039affd20decf0243f30a152776466729a6
TLSH
T17EB0128180019501C08202F4114354CC72189F20D70E1F0293E479228C265D08814090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c435.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c435.TMP
Size 96B
SHA256 82b6e752420d3d16344793a06d672d69ade2311fd9168a06eecd48e7f5ba30c6
MD5 cf39b26d5d83923fec87749d2ea30b36
SHA1 ffab26c99dcfe56a2c5f89ba1911fc6bed5ed546
SHA512 3a91d223a4fbab4de2f9cb8bcddd667b9f9788938b3cc345e6b6448b3f82ae35706efc5dd8c0720968a6c89b7f138f9e1b65520e4275af3964c3f12ddbd9916f
TLSH
T1B4B02208C003A202C00303B0BE8080C8B020CF23C203032282E00FA2CC20BB80222230
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 5901938d1baa1a05c87a77e77094a4d0cdb6df8494e674b808f4507dfc285593
MD5 2d703a8c773d5e7339fbf9e318ae9cfc
SHA1 16522646775d609d44dddf17c370a777312fc26f
SHA512 d80b02480a57d6b60f1eeeb1565fc96dc7b7f5ea7d1ec199cac7432644688482f557d4cac7cafcd229464e53841897d2ca5458b50c24daf1066fe91c6cdaa206
SSDEEP 6144:qSBPiyMkiCMnas2FZm7Rkm1tYpBeh2BAot:qSBKFk0na3S9oBGcAot
TLSH
T1713412399E649D3519B8DE1EB00F090A1EF256E2EC6DE986C4D51E0813DD7CA4F0BEB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 cb3e5bf59d537d30e127eded47880f8d61bac5c3f77b414c926889968b5ef198
MD5 2301a225255a9a0c67c5921558ab1b4b
SHA1 32da1ae309a0fd30519b8f61001da66c2eba8ce7
SHA512 230dceda7fac50ae33bc09441786f1c0a200c654ee99985318a1db8456143f934083e99a8d4de1fd7310463ce4d9d71d2ad18599bd8ac27e2c584ef10faf13ce
SSDEEP 6144:h3PiyMkiCMnas2FZm7Rkm1tYpBeh2BAot:h3KFk0na3S9oBGcAot
TLSH
T1263412298EA45D3515B8DE2EA00F090A1FF24AE1E97DA9C2C4D55E0823DD7860F0AEB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2924232cd00fb4c2b971f7ec1d6bef39a287443396394768e5843fd50341c641
MD5 0b459293453ced8b4ad493911cf30f14
SHA1 f501b5d744de74e0be01216c662f1ad1d36c9389
SHA512 124532defc0249ae500b5f692b8d7dff614efba62c18179c62ffb91fd84aed545e47829b5e42e86a01d90cd859618f9dbf8996d924f9e879d9e188c79cd90112
SSDEEP 3072:3dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:30m7Rkm1tYpBeh2BAoi
TLSH
T1EFC3123B5E60E9775875BB0EB08E0B1E2EF149A6C920DA82C8D85B0437FA7CC1A05974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 82b1c4a218bc4d75b594da0c5ca0ae6fb1761d2e0529dd267b2223b8f24c1ad2
MD5 3189606c7fa51bd32971b911d5236de8
SHA1 96ff5b0f139015aa5dc045a6e7214b154b307800
SHA512 f8029190615c0f6a4772bc5ae7494763300446953e474d0263493be965cda8cff90830822276ce6450bbfb40926cd81476559d04678a5f6cec68e100b2aa11b1
SSDEEP 6144:q3PiyMkiCMnas2FZm7Rkm1tYpBeh2BAot:q3KFk0na3S9oBGcAot
TLSH
T1C83412298EA45D3515B8DE2EB00F090A1FF24AE1E97DA9C2C4D55F0823DD7860F0AEB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3fa74f4b158331ca579b2684cf531db005e5a6cc7ce731bbf43708430df80cfc
MD5 f8de2c1cc956986bc0c8bdf102cf8b79
SHA1 680b77b6debfaac1d7f5ea5c6f9f90fe28459af4
SHA512 48aefd6346b9ed9785ad2c60bf5fa4c27d9326b99cad622df32a73ea9ec2fa3575ae21178bf92aa8135941b12bb9776bbf2ca55154d45023fca4b66fead90297
SSDEEP 192:nRGNK6yMQmiUyAJmU1Y3b+jcTjzorrifRzZMn0IPVU6:RGNK6xvT1Y3b+AD82hw0WVU6
TLSH
T15F02E936A8786CBB9FF3AE48B54737139FE4112BD9952F84D6E81F0C00D765C230A866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1383182527f0553ae8ce04222a9c89bba003af06f54f04489432326bb52e0734
MD5 35515785ad3ac6650d12fe79f9a80c7b
SHA1 860c172e4a47cf8c61ded84a9bf1e3c38c98561b
SHA512 6c31f98eafeae3a89a02f7bc7bb5247bf49c6e61c65c6df1d725085b76c5eff8e588448de67ecd574f4fdae9a1808866f2823f346bec7bad114c68f824ad2fa3
SSDEEP 192:IGN7h6ywQmiUyt0UYY3b+jcTjzorrifRzmXsb+2tJ4M0XqGwU6:IGN7h6ZiYY3b+AD82hmXsb+2J0FwU6
TLSH
T17012FA35A868BCA79FE3AE45F44737139FE8116B9A856FC4D6E41F1C04CB65C130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PAggregator.exe

Path C:\Users\Admin\AppData\Local\PAggregator.exe
Size 93KB
SHA256 e48ef14933f4eb6071497a5311ca0ac6e115f7a0d57a60e519296f8fd42ad4fe
MD5 802d1182a4685e1b86c0a9dcb3f2be36
SHA1 3aea1c3d1925ec0e6c4e534adcccb1271c6a5f04
SHA512 ebde9d7c89fed73ea1766fdbaf716e5ba69068b5b0c913490c9ad8703540945e2cda248b0365d6a49acecae960a8fa846da53cfbf8e19b98a6da382267dc562c
SSDEEP 1536:pTjiguRSshbhH7JG9cGJOkUPwoavqnzZnBBw3QMZblzmPxJ5:TTqrG9b45nzZBK3QMZblzSxJ
TLSH
T12D939E2274E1C433D55714726858D691ABBEF5332EB4C9473B9903BA4F213C1AB2B39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89e23dd2

Path C:\Users\Admin\AppData\Local\Temp\2209e604\89e23dd2
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

825EA60.tmp

Path C:\Users\Admin\AppData\Local\Temp\825EA60.tmp
Size 9.9MB
SHA256 e0b716f4b675a55c687fd3955028b850be769df05ff7bdc71b6c86ecfcadaf14
MD5 33169dd1064be5fdcddc79906ce1cb95
SHA1 6095b119650b56032f22184377d200e1361fabbb
SHA512 e0174ea213c85e39939ae1b9019c1406f6397d340c00aba63f9af64e311c691d4314fa755a7f05879267b9c5256a3e2dd97542e03b755968bb3cc3e88c24d738
SSDEEP 196608:WEvI2JZBu0fesKQRjd6YYu+zfiOMOKlvdbyEVC2/QS346TrMIXzhRoZ9O0:WEvDJZE0mI1R+zZMPCMCsD3bnZhmZQ0
TLSH
T1AEB63385D1DA0778FE752CA7F829305B05BB284F4721F50193C8989ACFFB0646B6EC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

825EA60.tmp

Path C:\Users\Admin\AppData\Local\Temp\825EA60.tmp
Size 9.9MB
SHA256 104369c140a61c5dd69dc1935a295922ba957f6a8f52ac3b0415cc3be3912260
MD5 12ef7c3e122e588645c881f5925f24ec
SHA1 c651964bef1bbff20183e2d8ab59f23e477f681b
SHA512 2f9434de01410c299c377286c7c82d56c86ccf8ad9f5fc4f96f8bbc46961f71e65505135a583cf0eba675c4f3d6b4452aa202868e28671711357700c46a2e37a
SSDEEP 196608:8VvI2JZBu0fesKQRjd6YYu+zfiOMOKlvdbyEVC2/QS346TrMIXzhRoZ9O0:8VvDJZE0mI1R+zZMPCMCsD3bnZhmZQ0
TLSH
T122B63385D1DA0778FE752CA7F829305B05BB284F4721F50193C8989ACFFB0646B6EC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

859EC83.tmp

Path C:\Users\Admin\AppData\Local\Temp\859EC83.tmp
Size 2.3MB
SHA256 2858a4fae35812a9e04735851d06352ab223056f5707f1c8f5330e2be666bfeb
MD5 eb6c3d878e39fa9d6757628946765065
SHA1 1c42e756efa3871e0d8431969a0fb2d440e458cf
SHA512 4111e24606aa32c2df490bbffcc37a87d39cec84220aca7989fb2da1c2cbce16bf307f2b513d6fdec0037b56f46df4b11062956948fc139d67597978386c5d01
SSDEEP 49152:cADKFfsovIp6bRLwH3PqSfProM2I1C/t0rnOdKNDgenSgtMzBf:beFf1vIp6FMSgjo40knOoZeggf
TLSH
T12EB533004AED013EF756F846E96B6143638600DA479DE2707BA977CE8CF056A9CD2F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

859EC83.tmp

Path C:\Users\Admin\AppData\Local\Temp\859EC83.tmp
Size 2.3MB
SHA256 a1334760776a373b9572bbccf02e7ae77c441e5048e6d4f3d7e29adf39be24e9
MD5 6a8c061681c103daeaa64ceb68bcc90c
SHA1 9b0df9f61db9b4b130f00abf9dc06d21e9ca55db
SHA512 503573818885a405c9079e2f7064a97580b56557eaa204616d4bacc1e6fb47dd91fc49f990c171804c7319fa7c36202411dd7b73d0d600ad85e027c9ad798d0d
SSDEEP 49152:2ADKFfsMvIp6bRLwH3PqSfProM2I1C/t0rnOdKNDgenSgtMzBf:NeFfZvIp6FMSgjo40knOoZeggf
TLSH
T161B533004AED013EF756F846E96B6143638600DA479DE2707BA977CE8CF056A9CD2F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CB81A5B.tmp

Path C:\Users\Admin\AppData\Local\Temp\CB81A5B.tmp
Size 40B
SHA256 16844693a0f40ee0a4eac4a044a929957107de3b986bf4a9a55740c0729a1a5c
MD5 69d709768f29f03353c994e58064d810
SHA1 599da80d51b0ddb89d0c6b5fef774a5673d6f0e2
SHA512 6c2f9496019df76c15d583183cb333b05024fec50626d97bdfb33fbfad9a0844286e4a7716e9caf277751c78664d4caeb5cd08c620bb25d21677c1c53ce55a3e
MD5 SHA1 SHA512

Submit Download

DecAlpha64.exe

Path C:\Users\Admin\AppData\Local\Temp\DecAlpha64.exe
Size 2.1MB
SHA256 c310af3495d8cd787fc19f2962403144ed134cd2fd55cd88c3719a4025d7fbc9
MD5 22cc827fde866241d29c51e77df41359
SHA1 32554a66c73dafeefd966551e3d836e94aaecca7
SHA512 09140e5999a893b3cf52739083559161fffc4ea960f2a6ed616114e803be28513da218a7266aa2d68497d61df96446b0f66696afc058cefc7bd104868c3f27fe
SSDEEP 49152:kSqOfyzwFMQmE4fTxJq44bNyngLymuNsMKcc2sXizNMSrpAE1:kTOf5FMQm7fTxJqTbNynsu+MKWUizNMc
TLSH
T1F6A55B313D9858F6C16302309ADCF27AFDBDA6740B3A53F71298DB1C7A714424E2766A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E862D37.tmp

Path C:\Users\Admin\AppData\Local\Temp\E862D37.tmp
Size 40B
SHA256 4d6f18d889fdc8a4d6a14d25c1a0fb7c30440eacda2d5e6a9e97687e7d425655
MD5 def8950c64d6223fc6a8a73c58647d20
SHA1 ad621e9f94bf0db854efc3bcddfc79e36f7ada48
SHA512 f4996716e5e6f1fb80303de79bef303af9b6061241da081be2aa5759266a7e42720b582055a8f897ab800712e77f65a5457deea3a8b4bc1fd39ef19d25441fe8
MD5 SHA1 SHA512

Submit Download

SsUCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\SsUCommon.dll
Size 1.9MB
SHA256 26210595727ae30048d0386a45e5b36cd7fd303e0a19862a108668ec652eaf10
MD5 ea27fb04dfd60c5fbedd2bdc5ba46efa
SHA1 02591b1ad4d27025234b157b296825309ee664b7
SHA512 b0abe5dd73bffd8b3d09a741a7ad8d51bd9acc1fe3c164c1203491c1eecc34c967a274919bc882e90c81a7fd705dba30bb21958d8514aaafa39ca210fc6b034c
SSDEEP 49152:/1pf0lSGaFQDXWA5cJbn5+zkRLIQ8W5lT4vcBMf:/1igBFQDXH5cJ1wkRLIilT4vc
TLSH
T1E4957D223B4C10F6D11B323C5519BA28F1BCB7A3CBB5C2C716969A5DB9328C64518F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba8d-15ba-6f17-ffb5.tmp

Path C:\Users\Admin\AppData\Local\Temp\ba8d-15ba-6f17-ffb5.tmp
Size 15KB
SHA256 5d2469ab68757e7b2d95a2c30476784b2c58e29db3dac6052518f8322afcb909
MD5 819fd2f1f033097ee1285ef1005f2e7c
SHA1 b90f26bc97514e3ee4dd0654f71abfb9e79f0416
SHA512 d2f4ff49201aae7576005c83e22a4ec045d915db7a707fbd33544ed48df3c2b1a3bde876f636af8015a40b3553263e2228384c9bc0d13435b44f138940dcc7df
SSDEEP 384:DwKYQVIyhYRdOZcpoUpqm46whoYa64rfXnZe1ACKar/Y0Zs49iHoScIDuMyMkWD:Dc4iRd+cD4pHYrvnZsXc0XIXpkWD
TLSH
T1BB62E0D23B44C54E799B202F6A39894C61FD0BA4EFA88C359E568DFECC4CB0C07445D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 493KB
SHA256 7a3d3b2dd5dbc304a1b0536ef0f9a41922e9ce06a25e9914a36d3160ba1f3d40
MD5 a91d604885dfb689678bc1cb5ae1d764
SHA1 3cf32b2eefbaf9bd49b278d8b11840db7cc70b5e
SHA512 d1387d768ff8c78a049880e4b16f57b98a3297048ccc5de3196889f2598e1bb265844f51e293a35c8190aea1b055bbda04e2e97528598a37398a7cdcaf6cf342
SSDEEP 12288:HeMcMmVRYcFERWKn9g82vWirmzbAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sq3a:HeMKYXQKn9g82vtubf03Ooc8dHkC2ecH
TLSH
T1BAB44B332A4109F1E48A23B4618D936283FDED650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

physicsdesc13.yaml

Path C:\Users\Admin\AppData\Local\Temp\physicsdesc13.yaml
Size 32KB
SHA256 356c4d2059e2cbe49a8607a64e38300d67d2583cb28f9d692fdfa1628e69694d
MD5 a72e063726d7e8e84ca78e22f4d92fb1
SHA1 57aacb3797ea261fad61079f1678e6785e7b2015
SHA512 c2441dcc03f8ec4e36a06e5a6cdbe6599649da859fed7355c55fa1d002f92a16712fb4df4999b4cec013357e6368a90d660b353e35f73239546e06a953d0a4db
SSDEEP 768:8ER39efB2dzNJ1tigTY3Kuz1xnQBtd8rvFHyXOKP68V7lBCGUxtG:8ER3aB2y6qQB/8Ll9KPTVn1UxtG
TLSH
T14FE29EFA5A256F54BD04FC7A9828B0A3D260F4F53D4F90F3B5962D0AB0254EAD411D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shader.cfg

Path C:\Users\Admin\AppData\Local\Temp\shader.cfg
Size 7.7MB
SHA256 b346c82a3b00aa9cd3a9afcade66a0f46f96fbed5f2bead4c709a328ba7f0870
MD5 941b8cc99e8865c2c61d7cc04c3b10a9
SHA1 b01a87b97f924cfaaf14c9352b5e864e1386e203
SHA512 25aa256caf4ef94dca6d47a00ba7e3f81053343687a4dcbb9f19ccc240f8810f7c05c3a80d0dced905d84eb0e7b826d8223b95b87478c38345969fac358b0bb1
SSDEEP 196608:BRHDXv2GSS6++f1M/jpFUhWxe74jlXToIe+it07B4+PK2:BRHL3SSj+2ghWxFpXToIet3QK2
TLSH
T1E38633D729DE0025C44AC87B727A9D918C7E34E283B5E5617C0FBAC8787E5252F847B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 b59c1f7e457b144a211b74b31492a68a7844232121c4046c7538b0d2ab3cfc31
MD5 6c6c82d1efb4a4f1663b274eb9c33938
SHA1 37ac5fc535269de784ee7a452e5a9bc6ea57798e
SHA512 933d9d109d6dcae8e69b634721a29b963d64330943fddadfd889bbbbd63690fe6beaf35f5d150dd2e29cff89b6379d187cf6a87d8b731c5b68bacdc749859fa2
SSDEEP 24576:/QeCoON4h/4z/G1YknUkY3Ub6lymQmcvIZPoy4yuhp1Rz+:YeCoONs42nUv3Ubftp11+
TLSH
T196358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shader.cfg

Path C:\Users\Admin\AppData\Roaming\TaskCache_arm\LWBMYGVBVHWOPMLLW\shader.cfg
Size 2.2MB
SHA256 3cfdc557a26de8aeb456c3e9f9f3071406176f5dbe69419b8b996665f001eecb
MD5 898fe84f408715b870409a2865077da0
SHA1 dd94f09b86080a5d9d732a1a52b8e21ea60f6d37
SHA512 55b92f611aa7e2c6b9586ca73e1ee2b174ab4498089408dae9dd212c456335ec26b419310e90b9da6b11dbc79b898ee603bd7ae25d8bbddf253df4167fdb525f
SSDEEP 49152:Smsm6gqPVSRLJe48uHlhDNeTcMHRNdHwYPxjr28NwDOMc8mKB:j6gqPVALJe48uFzAc2N/Jjr267MrLB
TLSH
T181A53358058CC5BBDA3A65B3B9C86C5192C2EA2F4BBC0897164A6CFDB46D038FC5D7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\toolhost_v5\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1176-86-0x0000000074CB0000-0x0000000074CFF000-memory.dmp

Download

memory/1176-84-0x00007FF990520000-0x00007FF990729000-memory.dmp

Download

memory/1176-103-0x00000000006F0000-0x000000000090B000-memory.dmp

Download

memory/1176-93-0x0000000074CB0000-0x0000000074CFF000-memory.dmp

Download

memory/1176-83-0x0000000074CB0000-0x0000000074CFF000-memory.dmp

Download

memory/1676-172-0x00007FF990520000-0x00007FF990729000-memory.dmp

Download

memory/2308-398-0x00007FF638490000-0x00007FF6386C3000-memory.dmp

Download

memory/2308-437-0x00007FF638490000-0x00007FF6386C3000-memory.dmp

Download

memory/2308-334-0x00007FF638490000-0x00007FF6386C3000-memory.dmp

Download

memory/2308-113-0x00007FF638490000-0x00007FF6386C3000-memory.dmp

Download

memory/2308-179-0x00007FF638490000-0x00007FF6386C3000-memory.dmp

Download

memory/2308-361-0x00007FF638490000-0x00007FF6386C3000-memory.dmp

Download

memory/2308-211-0x00007FF638490000-0x00007FF6386C3000-memory.dmp

Download

memory/2308-223-0x00007FF638490000-0x00007FF6386C3000-memory.dmp

Download

memory/2608-75-0x0000000074CB0000-0x0000000074CFF000-memory.dmp

Download

memory/2608-64-0x0000000074CB0000-0x0000000074CFF000-memory.dmp

Download

memory/2608-89-0x0000000074CB0000-0x0000000074CFF000-memory.dmp

Download

memory/2608-55-0x0000000074CC7000-0x0000000074CC8000-memory.dmp

Download

memory/2608-67-0x0000000074CB0000-0x0000000074CFF000-memory.dmp

Download

memory/2608-68-0x0000000074CB0000-0x0000000074CFF000-memory.dmp

Download

memory/2608-60-0x0000000074CB0000-0x0000000074CFF000-memory.dmp

Download

memory/2608-63-0x0000000074CB0000-0x0000000074CFF000-memory.dmp

Download

memory/2608-88-0x0000000074CC7000-0x0000000074CC8000-memory.dmp

Download

memory/2608-54-0x00007FF990520000-0x00007FF990729000-memory.dmp

Download

memory/2608-53-0x0000000074CB0000-0x0000000074CFF000-memory.dmp

Download

memory/3204-37-0x00007FF990520000-0x00007FF990729000-memory.dmp

Download

memory/3204-36-0x00000000731F0000-0x000000007323F000-memory.dmp

Download

memory/4276-182-0x0000000074CB0000-0x0000000074CFF000-memory.dmp

Download

memory/4276-125-0x00007FF990520000-0x00007FF990729000-memory.dmp

Download

memory/4348-120-0x0000000000400000-0x00000000007A9000-memory.dmp

Download

memory/4348-213-0x0000000000400000-0x00000000007A9000-memory.dmp

Download

memory/4348-128-0x0000000000400000-0x00000000007A9000-memory.dmp

Download

memory/4348-302-0x0000000000400000-0x00000000007A9000-memory.dmp

Download

memory/4348-397-0x0000000000400000-0x00000000007A9000-memory.dmp

Download

memory/4348-190-0x0000000000400000-0x00000000007A9000-memory.dmp

Download

memory/4348-95-0x0000000000400000-0x00000000007A9000-memory.dmp

Download

memory/4348-430-0x0000000000400000-0x00000000007A9000-memory.dmp

Download

memory/4348-99-0x0000000000400000-0x00000000007A9000-memory.dmp

Download

memory/4348-438-0x0000000000400000-0x00000000007A9000-memory.dmp

Download

memory/4348-102-0x00007FF990520000-0x00007FF990729000-memory.dmp

Download

memory/4348-455-0x0000000000400000-0x00000000007A9000-memory.dmp

Download

memory/4348-457-0x0000000000400000-0x00000000007A9000-memory.dmp

Download