hijackloader | faafc408fb5b3f6907b1033f89bc6b8569d602c7e80532801e99af4dca1110f6

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/06/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kythy.exe
Size 9.9MB
Sample260618-lpbbnsat3z
SHA256 faafc408fb5b3f6907b1033f89bc6b8569d602c7e80532801e99af4dca1110f6
MD5 1547ece531048c43158517daec04a0f8
SHA1 ff6d03be9c128d8739ddde6ac744e37fbfef6a04
SHA512 c27a29ffba9137479ba201c5b9bc1e80a1880d3fe4b8736d5eafc154bd1bf5a42a1e464637febf755ca9e8e6c6f180f60db7312651cea42c3171bb634e9cfdb4
SSDEEP 196608:+p1lOqylhm+91VFNRS4Zrw5DEGGS2FRybV7aB/zw01FoiXYg0D:+pGlYAV3RSc4DESWB7oBgQ
TLSH
T140A6331273A011FBE511C6F1AF5DEF225633F34012142B17AAE9EE167E2782B460B6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\NanoCache_win64
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002b3ed-29.dat	family_hijackloader
behavioral2/files/0x001900000002b551-80.dat	family_hijackloader

Suspicious use of NtCreateProcessExOtherParentProcess 28 IoCs

description	pid	Process	procid_target
PID 2484 created 3172	2484	TurboA128.exe	90
PID 2484 created 4020	2484	TurboA128.exe	91
PID 2484 created 4968	2484	TurboA128.exe	92
PID 2484 created 2248	2484	TurboA128.exe	93
PID 2484 created 4600	2484	TurboA128.exe	94
PID 2484 created 1872	2484	TurboA128.exe	95
PID 2484 created 5060	2484	TurboA128.exe	96
PID 2484 created 5112	2484	TurboA128.exe	98
PID 2484 created 1764	2484	TurboA128.exe	100
PID 2484 created 3172	2484	TurboA128.exe	90
PID 2484 created 3172	2484	TurboA128.exe	90
PID 2484 created 2248	2484	TurboA128.exe	93
PID 2484 created 2248	2484	TurboA128.exe	93
PID 2484 created 5036	2484	TurboA128.exe	103
PID 2484 created 924	2484	TurboA128.exe	104
PID 2484 created 4580	2484	TurboA128.exe	105
PID 2484 created 4512	2484	TurboA128.exe	106
PID 2484 created 572	2484	TurboA128.exe	107
PID 2484 created 4748	2484	TurboA128.exe	109
PID 2484 created 1752	2484	TurboA128.exe	112
PID 2484 created 3664	2484	TurboA128.exe	113
PID 2484 created 2784	2484	TurboA128.exe	114
PID 2484 created 5280	2484	TurboA128.exe	115
PID 2484 created 5356	2484	TurboA128.exe	116
PID 2484 created 5036	2484	TurboA128.exe	103
PID 2484 created 5036	2484	TurboA128.exe	103
PID 2484 created 4580	2484	TurboA128.exe	105
PID 2484 created 4580	2484	TurboA128.exe	105

Executes dropped EXE 3 IoCs

pid	Process
4452	ERaz.exe
4624	ERaz.exe
776	ERaz.exe

Loads dropped DLL 10 IoCs

pid	Process
4452	ERaz.exe
4452	ERaz.exe
4624	ERaz.exe
4624	ERaz.exe
776	ERaz.exe
776	ERaz.exe
2484	TurboA128.exe
2424	EthArray.exe
1352	Crisp.exe
2112	Crisp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2484	TurboA128.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 4624 set thread context of 2484	4624	ERaz.exe	84
PID 776 set thread context of 2424	776	ERaz.exe	83
PID 4624 set thread context of 1352	4624	ERaz.exe	85
PID 776 set thread context of 2112	776	ERaz.exe	86
PID 2424 set thread context of 3172	2424	EthArray.exe	90
PID 2424 set thread context of 5256	2424	EthArray.exe	123
PID 2424 set thread context of 3172	2424	EthArray.exe	90
PID 2424 set thread context of 8	2424	EthArray.exe	129

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	EthArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	EthArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	EthArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	EthArray.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	EthArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	EthArray.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	EthArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	EthArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	EthArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	EthArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	EthArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	EthArray.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	EthArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	EthArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	EthArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	EthArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	EthArray.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Third Party Notices.txt	EthArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	EthArray.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	EthArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	EthArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	EthArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	EthArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	EthArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	EthArray.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	EthArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	EthArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	EthArray.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\Tasks\debug_executor_v4.job	Crisp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kythy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ERaz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ERaz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ERaz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EthArray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2248	chrome.exe
4580	msedge.exe
5216	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TurboA128.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TurboA128.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134262493719386803"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2424	EthArray.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4452	ERaz.exe
4624	ERaz.exe
4624	ERaz.exe
776	ERaz.exe
776	ERaz.exe
776	ERaz.exe
776	ERaz.exe
4624	ERaz.exe
4624	ERaz.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
1352	Crisp.exe
1352	Crisp.exe
2424	EthArray.exe
2424	EthArray.exe
2112	Crisp.exe
2112	Crisp.exe
2424	EthArray.exe
2424	EthArray.exe
2424	EthArray.exe
2424	EthArray.exe
2424	EthArray.exe
2424	EthArray.exe
2424	EthArray.exe
2424	EthArray.exe
2484	TurboA128.exe
3172	chrome.exe
3172	chrome.exe
2424	EthArray.exe
2424	EthArray.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2424	EthArray.exe
2484	TurboA128.exe
2424	EthArray.exe
2424	EthArray.exe
2424	EthArray.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2424	EthArray.exe
2424	EthArray.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2424	EthArray.exe
2424	EthArray.exe
2424	EthArray.exe
2424	EthArray.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe
2484	TurboA128.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2424	EthArray.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4624	ERaz.exe
776	ERaz.exe
4624	ERaz.exe
776	ERaz.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	EthArray.exe
Token: SeDebugPrivilege	2484	TurboA128.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeDebugPrivilege	2424	EthArray.exe
Token: SeDebugPrivilege	2424	EthArray.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 4452	3200	kythy.exe	80
PID 4452 wrote to memory of 4624	4452	ERaz.exe	81
PID 4624 wrote to memory of 776	4624	ERaz.exe	82
PID 776 wrote to memory of 2424	776	ERaz.exe	83
PID 4624 wrote to memory of 2484	4624	ERaz.exe	84
PID 4624 wrote to memory of 2484	4624	ERaz.exe	84
PID 776 wrote to memory of 2424	776	ERaz.exe	83
PID 4624 wrote to memory of 1352	4624	ERaz.exe	85
PID 776 wrote to memory of 2112	776	ERaz.exe	86
PID 4624 wrote to memory of 1352	4624	ERaz.exe	85
PID 776 wrote to memory of 2112	776	ERaz.exe	86
PID 3172 wrote to memory of 4020	3172	chrome.exe	91
PID 3172 wrote to memory of 4968	3172	chrome.exe	92
PID 3172 wrote to memory of 2248	3172	chrome.exe	93
PID 3172 wrote to memory of 4968	3172	chrome.exe	92
PID 3172 wrote to memory of 4600	3172	chrome.exe	94
PID 3172 wrote to memory of 4600	3172	chrome.exe	94
PID 3172 wrote to memory of 5060	3172	chrome.exe	96
PID 3172 wrote to memory of 5060	3172	chrome.exe	96
PID 3172 wrote to memory of 1872	3172	chrome.exe	95
PID 3172 wrote to memory of 1872	3172	chrome.exe	95
PID 3172 wrote to memory of 5112	3172	chrome.exe	98
PID 3172 wrote to memory of 5112	3172	chrome.exe	98
PID 3172 wrote to memory of 1764	3172	chrome.exe	100
PID 3172 wrote to memory of 1764	3172	chrome.exe	100
PID 3172 wrote to memory of 3372	3172	chrome.exe	101
PID 3172 wrote to memory of 3372	3172	chrome.exe	101
PID 3172 wrote to memory of 1508	3172	chrome.exe	102
PID 3172 wrote to memory of 1508	3172	chrome.exe	102
PID 2484 wrote to memory of 5036	2484	TurboA128.exe	103
PID 5036 wrote to memory of 924	5036	msedge.exe	104
PID 5036 wrote to memory of 4580	5036	msedge.exe	105
PID 5036 wrote to memory of 572	5036	msedge.exe	107
PID 5036 wrote to memory of 572	5036	msedge.exe	107
PID 5036 wrote to memory of 4512	5036	msedge.exe	106
PID 5036 wrote to memory of 4512	5036	msedge.exe	106
PID 5036 wrote to memory of 4512	5036	msedge.exe	106
PID 5036 wrote to memory of 4748	5036	msedge.exe	109
PID 5036 wrote to memory of 4748	5036	msedge.exe	109
PID 5036 wrote to memory of 4748	5036	msedge.exe	109
PID 5036 wrote to memory of 3540	5036	msedge.exe	108
PID 5036 wrote to memory of 3540	5036	msedge.exe	108
PID 5036 wrote to memory of 3540	5036	msedge.exe	108
PID 5036 wrote to memory of 2784	5036	msedge.exe	114
PID 5036 wrote to memory of 3664	5036	msedge.exe	113
PID 5036 wrote to memory of 2784	5036	msedge.exe	114
PID 5036 wrote to memory of 2784	5036	msedge.exe	114
PID 5036 wrote to memory of 3664	5036	msedge.exe	113
PID 5036 wrote to memory of 3664	5036	msedge.exe	113
PID 5036 wrote to memory of 2628	5036	msedge.exe	111
PID 5036 wrote to memory of 2628	5036	msedge.exe	111
PID 5036 wrote to memory of 2628	5036	msedge.exe	111
PID 5036 wrote to memory of 1752	5036	msedge.exe	112
PID 5036 wrote to memory of 1752	5036	msedge.exe	112
PID 5036 wrote to memory of 1752	5036	msedge.exe	112
PID 5036 wrote to memory of 5280	5036	msedge.exe	115
PID 5036 wrote to memory of 5280	5036	msedge.exe	115
PID 5036 wrote to memory of 5356	5036	msedge.exe	116
PID 5036 wrote to memory of 5356	5036	msedge.exe	116
PID 2424 wrote to memory of 3172	2424	EthArray.exe	90
PID 2424 wrote to memory of 3172	2424	EthArray.exe	90
PID 2424 wrote to memory of 3172	2424	EthArray.exe	90
PID 2424 wrote to memory of 3172	2424	EthArray.exe	90
PID 2424 wrote to memory of 3172	2424	EthArray.exe	90

C:\Users\Admin\AppData\Local\Temp\kythy.exe
"C:\Users\Admin\AppData\Local\Temp\kythy.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\ERaz.exe
  "C:\Users\Admin\AppData\Local\Temp\ERaz.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\ProgramData\NanoCache_win64\ERaz.exe
    C:\ProgramData\NanoCache_win64\ERaz.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Users\Admin\AppData\Roaming\NanoCache_win64\OEMJGSCOQTDIN\ERaz.exe
      C:\Users\Admin\AppData\Roaming\NanoCache_win64\OEMJGSCOQTDIN\ERaz.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:776
    - - C:\Users\Admin\EthArray.exe
        
        C:\Users\Admin\EthArray.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2424
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:5256
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:8
    - - C:\Users\Admin\AppData\Roaming\TracerKubernetes_v2_0\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\TracerKubernetes_v2_0\Crisp.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2112
  - - C:\Users\Admin\AppData\Local\TurboA128.exe
      C:\Users\Admin\AppData\Local\TurboA128.exe
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff9ef0fc188,0x7ff9ef0fc194,0x7ff9ef0fc1a0
        6⤵
        
        PID:924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,9344585289373644987,12326659991539233231,524288 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:4580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1544,i,6411392650071976043,6813410115028669486,262144 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
        6⤵
        
        PID:4512
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,4434740469842750007,9440580400290218310,524288 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:13
        6⤵
        
        PID:572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,11293225977821713468,17113815760885456007,2097152 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
        6⤵
        
        PID:3540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,2322774277971201051,8570152849480813697,2097152 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        6⤵
        
        PID:4748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4000,i,6480085918237397997,15556272587805066057,2097152 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
        6⤵
        
        PID:2628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4012,i,13547846854566531044,11827074635878143973,2097152 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
        6⤵
        
        PID:1752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4024,i,10689347483040343354,3064067837486160211,2097152 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
        6⤵
        
        PID:3664
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4036,i,1465768198342923371,9904053083062416344,2097152 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:9
        6⤵
        
        PID:2784
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,11241263853261147690,6438745119101653161,524288 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
        6⤵
        
        PID:5280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,4521136009504999179,3255093236387553276,524288 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
        6⤵
        
        PID:5356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,14845465758531368000,15734700024544603796,524288 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
        6⤵
        
        PID:4684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,15194393001096819798,2081598679926765657,524288 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
        6⤵
        
        PID:4056
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,7697398395732847223,4626775666376303044,524288 --field-trial-handle=2144,i,8604091923460839694,4154743516463620638,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:14
        6⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Roaming\NanoCache_win64\Crisp.exe
      C:\Users\Admin\AppData\Roaming\NanoCache_win64\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:2340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9f2f0c728,0x7ff9f2f0c734,0x7ff9f2f0c740
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,10993272972537149254,16821864007081378330,262144 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,10432702867940286748,6079726921240509272,524288 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,10684957128275343260,822830187664191061,524288 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2760 /prefetch:13
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,6979731367590421564,4740227860719260565,2097152 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,10823146592754505748,9461232106128272567,2097152 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,18289810930555859968,11858515073230379218,2097152 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,17928906899428804651,8164416357223684632,2097152 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4608,i,11657488169377534701,13497793771202913452,524288 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5064,i,12590842577884782705,16721270108185080901,524288 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4576 /prefetch:14
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5024,i,14448504795241523199,6309362874333082640,524288 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,14453238754761628393,599797501199993500,524288 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5024,i,13487656044616502837,4865300910772061258,524288 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4976,i,13931902709094080748,6014559586927447050,524288 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,10554894257282035009,7063124266213053835,524288 --field-trial-handle=1916,i,10224978265949098645,16505720852089770532,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7b4f4331768e43f0fda804731d7daddf9139fdb200d7d94c42d8f79c72b46835
MD5 f4fcee0e05a301159aabb56cbdff0001
SHA1 17bfbbae9cda4d603659ee4bb889daef89a1a94b
SHA512 343aeb2f74bcda33a8863834fcf3879ff91bbd7d6091385b805fa0d92798ab307597fad2f3fb2c5ec37bb3d2166e76ccb430a7874fd5af902fa64741145bdc81
TLSH
T140E0EDAACC209C2B09FE171C30505A42F610132B3B8059AB363C820D8FB4ABE428A86C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 340a621a59c360375ac6c52663f352e0377e596da7f621f385096cc8530c089c
MD5 1294dae77dc8fdf1a6cab637a9f5ad80
SHA1 25402364819ec43261e452e0e85ee3973154eb15
SHA512 30201b7789ddd4f2ce4cb9a690663848be1bfd39d54cf59c0f67caced8f2eea2bbf32c9464be4b3f7b45934e7b6f395461fec2ea5f40e2826d9a8720b46d9549
TLSH
T132418BF7C3E49A7D891156F4AB257F1FCD290A14131C3D56C9D4AF0B93E28B6D20024E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1aab4ce4816f731bf4ab5f15c3f8890acc394c5c5face57d22c558d895834f56
MD5 b8fa741dafcc5c19284a79861549b05c
SHA1 742dba2811a591ca31399908722f0a4b66ebed34
SHA512 6576e7de62c84ffc5323c93496ad0ec1b1ee1d2b37448da39b56a21b736f051134d9630782dfe05a8c9083d9c92c9445e02d7d7484fcac9587036e1c4cd3786d
SSDEEP 192:0RwsV8ht+WBem5v7+pAPRp279uHsb+WNnTg05fncukwiChAVyIsnAUgtaJ:0RTVZOZ6UXkUws0dncuCZ8
TLSH
T1CB42D72EEA51653B5CDBD329F9227B13E7F5113632951E84EAFC8A2C05D75CC222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 022a7c8eb9dc48e630ce7676fc011f1129db57d5c5ab4792b3eb86d6d91d3056
MD5 1f9e89c2d4d646241b467a0415042573
SHA1 0e41e78348d6d859b260c420c5b129362d99bab3
SHA512 3b9aa96c37b035385898be778c0910f1aabe19c75ce25dfbb15c0d42a4f2d18c39b3e98f47a60da04b086c126031e5a0eda0146b0362aa431b6ebfec9a5669cf
SSDEEP 192:0RwsVcht+WBem5v7+p1PRpx79uHsb+WNnTg0HfncukwiCjAVyIsnAUgraJ:0RTV5OZ6/XFUws0/ncuCRe
TLSH
T1C252D81EE951693B5CDBD329F9227B13E7F5113632941E84EAFC8A2C15E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3937cbc0c00dedd7dd91ecbe1e8885276d50150af81d1bc5bb6a1a90663153f9
MD5 22817d970a61819308a0016a3e4e40a0
SHA1 2a8abd915ae5681e68286f9a0a7d184518cce9df
SHA512 c13b2fddc7dea39dc118bd14cc5e8417f81aa2c6d128d105d345a0d0f6a3a16a769b95b57f7d689ad645f9827fcbe0ec8b7f991a9d5362b7f738177000e6d073
TLSH
T18CB0124184019101C04207F4118214CCB168DF51A70F170243F079328839150C415194
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59714e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59714e.TMP
Size 96B
SHA256 f7b0d7423bba2df63ac07ecb2659ae8dd506663947feb69550bdab199538dde0
MD5 605db8c7a4e6868e6ef7fb06dcb4bc4a
SHA1 ad3ed2fb417043f3698665303151608ad3f22dca
SHA512 ff51f1427c0c81d2f99fa164aae841d3fa753676e91a91559c5ec73734c2163798a0c56cfd8b3555471f3075818fab41e3b1ac3e902f34a09bd4346918a525c9
TLSH
T1D5B02208C0032202C00203B22A8382C83020CF32F2030302C3F00A32CC20E20C2282A0
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 092bcec6376010aadb0e080a4285ba54eebca80bf03e5912de49c3bb97464aa2
MD5 f4cddc1efadfc6708a239aac24798abb
SHA1 4a545c03ab40b980159c3fa93ea3bfb6d1b52828
SHA512 081b39c0e2bf79f17629b0daadedc5090e20dbe3406ec9fc2b52768a3d48f282141bb6612b5aab7c8a27df18e68360135b946a523dcb1509627108281c8a986d
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OzagaVumrLnPto:1nbZeMrv/hGtzzSLnW
TLSH
T162D3874B3A743102DDE69A721CF054BB5E3CB16D8F51A5D428B620588EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 c445ab8e8cabc984a4600058e9dd38b83ece466e061518702c56fae7b44e060a
MD5 696224ce2142e1b1b7075473df6b418d
SHA1 466be2a0df824227b8e93b303b35a8c37d74a036
SHA512 1a9e9c3374ed783e5e161fa6a9ed6043f9a3fe7a5fdd6502941e73ccf91c083c649f144471e41c81d4b7ee58e5fc7fca400c7c89228be60b6c990e1d57a1a427
SSDEEP 6144:2GXv/tN/v+lbmDYwCcmXKegIh6jh9Jvexh7:2Q3ulmEwCHHgVUxh
TLSH
T17434123539573E8748AC7E32B01A37598A711BC73D84F68E9594EF06C2C9EE5282F864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 da9cc5770339b417e351db943e6af3ed7c05b521627284939a6bfcc61ca8e447
MD5 f7498d70313c9639c91fb8a463204e6a
SHA1 8a5d3b6d0a6bcdbff74e928b7ca89e2fe45d9276
SHA512 14cedb7adbe876fd6251cd8c568be16bf55ed14842a33b07bfbbc74fe259ba9a36ec34517f799d943a86774f1ab2f6188efb3193beff362771ba446c690c82d5
SSDEEP 3072:a8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:8wCcmXKegIh6jh9JvexhQ
TLSH
T195B3125A29273DA688BC6EB37457338286A353A26C05F14E90CCDF0A45DDDF415EB8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 002f645b0c5ea2b68a4864f20fac13067fa9c020d40744d306bf1fb86d4c0b58
MD5 83ccde2886d35dbf5f51c5705ba122c0
SHA1 3cf171e6561e94f7926405f9d3f28275d571b523
SHA512 6bee589ed4318bf90b2d04d938108ac924a0ebf18f65b21e84e4437f8772d9894f2782df2543384afa5ba8ccf747cf0f71a96fc31e61895ea86f1f99053124cf
SSDEEP 6144:XGXv/tN/v+lbmDYwCcmXKegIh6jh9Jvexh7:XQ3ulmEwCHHgVUxh
TLSH
T17634121979573E9788ACBE32B42A375982611FC53D85F28F8194EF07C2C9EE5242F874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 b645b722a0b9f0e0c2c4b4ee238582855e2c8922374342d3fdf122a6445ac56b
MD5 fb4d01691669ea6e28659bfb355724eb
SHA1 9b56c0f7ded8df51fe6c0e95b9f6178a7091512a
SHA512 e165d25c37931de51e336b372e4a4033e5f53f3753aaa6e25bb942f141848d0deff660d068232a1998d278ad012a1e3f4d2ec6411169c838bffe6efa8f2c8ed6
SSDEEP 6144:OGXv/tN/v+lbmDYwCcmXKegIh6jh9Jvexh7:OQ3ulmEwCHHgVUxh
TLSH
T1AA34121979573E9788AC7E32B42A375982611FC63D85F28F8194EF07C2C9EE5242F874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da6c5d254765c139d88192f3f87e3d379a910f8e52b353e7ac5ddf08b3a1c1e1
MD5 92ebaa360a8cb89cce73739366d6c2aa
SHA1 54f15e16201d7ea62a290d02deaa9c8de7711281
SHA512 c367b21abf536f170820cab99bc5dfe90a29c2a9a6843a258c59b6bccc5f76b38b3b445ed981e71abf0ba91dad8e9c9507735c111b9ef5a78c34203ff9c73eb4
TLSH
T174D02B643B0E7041DB01003188118380116C50461073D30370F8004CCC8648053840C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b442494723fd224268df79958ea0f6d02b8bba5bea3b3ac773cd572188d3a54
MD5 744bc3e383e66c5e221c69d7866979a3
SHA1 a89cee038cab1b053cd20cf1ba1a2467efcfef52
SHA512 62751edb16ad3ba8ef9ff81ec4a923799479a4deb5a75300cbebc6ae373e5658010fe133cf354458f41695b960e04c278e50b65bb42bcb75fd101221aac3c409
TLSH
T1B4D02B643B0E7041D701003188128380116C50461073D20370F8004CDC8544053840C3
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 44b886e14c661526f5d4eccce3bae70db793b1b5cf98b02eaa2dc2902082b7fc
MD5 569c76c8fc50df882b7fb72468f0e92b
SHA1 7aad51e3bfe748cf4155149db29b3a93bf403c64
SHA512 410a7f8e44e6246ef5d736136dd45e6e35bdaf0a54b0deae501fb2f0da74154a7580dc27c5483d32662b9d4e3d4511d64b9d66362a539fbe913c2581657c0d16
SSDEEP 192:FvoWIOb1fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:ajcfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T17B24540A7B747001DDE7E9725CB080771E3CB16ECF22A6915DA254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 35139d67db6134c3ba5e02fd8df6cc665cdfe8d0aea8cad86357ea459f8514b3
MD5 165c6f520addf811144b8da334e74980
SHA1 1076900531858bdfaba6bf59f58457bcd9e2861f
SHA512 f72186176d28e27bbbb04be08106ea8e6920955299b251ea9de52d208702763523e960a5f260e3d087a48618750b7998982d4c9a4d8290d22272a4c7e6e148cf
SSDEEP 192:1GNu6t6H3BQmiUy7HBHw2Qq/rUH5mWndDD9MVojU6:1GNu6MXfoq2Qq/E5Td2ujU6
TLSH
T18802CA347868ACBB8DB3AE45B58777239F95117FEAD41F84D5E81B1C01DB68C1342832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 50e3873155519731cecc3ccb64ff1cc021035b6cc514a0d698add85b0921ec5c
MD5 174df9cdb8b9a43c3e456cdcbf511254
SHA1 69793219cba9dda1df92fac722dfb3505d4363b2
SHA512 e041782ff7364409b7bcdcb2b009bc891cd3eafc98a4a6157c93bf0dc0b9741702ff279dcae03879c0b8618212d19185473d2894508a978b0825d0cc272ec1b0
SSDEEP 192:fGNb6t6H3oQmiUyVl0w24q/rUH5mWndLp3/9nzq4U6:fGNb6MXI624q/E5TdLpVnU6
TLSH
T1CE12FA34B8A8BCAB5EA3AE55F4477B139F95117FAAD41F94D8E91B1C01CB5CC2306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24A7F7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\24A7F7C.tmp
Size 11.8MB
SHA256 83aa70865902d4f7ac5e2ba3a561921540c5a83baefde8256ce93492753ac450
MD5 69db5fd00eb18c56a022419f33828f53
SHA1 56a648ecbf824f39a41e145e8fde9ef4b0c1e6a0
SHA512 cae741a9a91398c2a89096f451d840ee0f287fdfd3b8db2b6cf101477e110717d2d1ed7b758e8b0fd2f0580f92fd713a0a3c9b271789f0f455ef9b45043a9a0e
SSDEEP 196608:JUADZH26mnSclLDfPUkg0jJrujPed6WSFqF2yfPjh+LEXugLC7kowWjLFz7ceMiy:JUYZW6ZELDfK0jJujPeGIMgLC7ko5jqJ
TLSH
T1CBC633F960FC974BBBFC3950121D49FA8A6ECE9709A0ECD3165F252ADDC9B101252C39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24A7F7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\24A7F7C.tmp
Size 11.8MB
SHA256 dfb3609b698ab3742f00df989296175dcb39ac4ba19d8a77ccc591af7384c2ba
MD5 1125584297d22b3b3ea8458316f484f3
SHA1 041bc366983db3ac890c4d1ecb2cd640c7361454
SHA512 31a178bfa2e33b55f4f3edf956445e006d7206d77c08b86e2a420d4fa52c1af6d1aaac7a6b2f178151bc971c37dd8dcfb8eaf060d47b0b32c40d03edb04be260
SSDEEP 196608:XUAuZH26mnSclLDfPUkg0jJrujPed6WSFqF2yfPjh+LEXugLC7kowWjLFz7ceMiy:XUBZW6ZELDfK0jJujPeGIMgLC7ko5jqJ
TLSH
T1ACC633F960FC974BBBFC3950121D49FA8A6ECE9709A0ECD3165F252ADDC9B101252C39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2B583E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\2B583E1.tmp
Size 4.2MB
SHA256 b37dc62566b1607da16e9188ffb4ea95075b50f56bda44ef86a7420236f29266
MD5 e81ec2c13a59ab421f09a61ab4e21159
SHA1 35a2d3dfa944e4fb5b5858ce63913d912e5a5a0f
SHA512 f530bd07f875c9555a10e446f47185d91ce673db12af625e2627e83ff8ed86605d82f930b6c8fb24693a5fd6fcfadf5d0e780aeedd2908b781c661d62b8f4260
SSDEEP 98304:WUENwiaar+MAs3B/yYxeat8T8/ecS96yXXo8pkDXeiHCVBIW:WUADRXN8TCeB6yXXbcuiHCVaW
TLSH
T1961633D717939F9B58862073EA6BE13AC1126B01F9A0AD58E8275B834D81331973C77F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2B583E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\2B583E1.tmp
Size 4.2MB
SHA256 41b3ae99f7f3d9b2343bbcabb506a829fe513258a3e7e60b817b2bfff3442bbd
MD5 b01010911664307e4f6887c7ef7c2cf5
SHA1 a94d53de7c3cfcd53d24470a71b4b6351a64c9a6
SHA512 f4fa3a88882cd5f47e0d7662565962e9f71a0478e422bc836478de5a2f35c07b186c1caecd65e2929b857cb58d20c23e9a973dc7c1d7a013f40769cc075ac54e
SSDEEP 98304:sUENwiarr+MAs3B/yYxeat8T8/ecS96yXXo8pkDXeiHCVBIW:sUAiRXN8TCeB6yXXbcuiHCVaW
TLSH
T15E1633D717939F9B58862073EA6BE13AC1126B01F9A0AD58E8275B834D81331973C77F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a14-963e-4911-b809.tmp

Path C:\Users\Admin\AppData\Local\Temp\3a14-963e-4911-b809.tmp
Size 19KB
SHA256 374f553b9582674bf006b7ee38542fd4ff5cea6b84fd912795edad8a5b108099
MD5 d8cb087d02bf5cc01627eaf74575d973
SHA1 2d7d2b0775603ae240ece65e2112eeb0c7d3f5a2
SHA512 d0333b06b43cf13e2352156757b451112f71a531555b10df2ef9212886ac5181cd38054e99a4609a53de5252fa59ce1a703f569757531d99eb41407274840c4f
SSDEEP 384:+B7pjKihOijaINxkZTklLHdTNgZVryaJxfa7DBIxTAvmSarIf9oo+:wp1aRklDdT6rDJxa7DBsLFrE9A
TLSH
T18992E00F12E94EF9A8FD9C2822049F2847C297F5588B0701C3325FBD89825B7E57213B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

704B10D.tmp

Path C:\Users\Admin\AppData\Local\Temp\704B10D.tmp
Size 40B
SHA256 3292f7d62f428492a554eb236555d714364ef3cc657885d516246ceb7013cd14
MD5 9ae2b019f7cc72a687e863a248949f45
SHA1 ae4464fdb7bddc5b1d62faf207f09e1cbac7e951
SHA512 5cac994803febdbe34a9b56ea8540cda3c45a0df5cd26f322f8d5b4eba611571ba14839e7de7f22c0ee7d83eeeea26bb6f82fdd01b299777405d3723e11e2e18
MD5 SHA1 SHA512

Submit Download

74EB41A.tmp

Path C:\Users\Admin\AppData\Local\Temp\74EB41A.tmp
Size 40B
SHA256 04429e4396d3c30252cf8b1a01b32d39be1615648c3794848e93fb05122f659e
MD5 94584492e8ca63280cee078950256a88
SHA1 2d7f88c5df75cca6c54c64d8dec82008d2fed42a
SHA512 08375a5794b982b48d41b8b8809fe483f45e5eb64e62aaa4b67a112356316f6a42458fc2dceab4acc10b320bff45e71c870d2c2a9fc4705e3fc54d8d401993c4
MD5 SHA1 SHA512

Submit Download

ERaz.exe

Path C:\Users\Admin\AppData\Local\Temp\ERaz.exe
Size 1.9MB
SHA256 9af57682d2053d479628b3e4f53ed630d3661d30fc553fe65966ffcb2c9101a3
MD5 28ff9e2bb67036f134e0bdfd0011778b
SHA1 e35d79782e7ef8ba240e479c10e8ae737eb52ddf
SHA512 08915ad750854b6332120eb6231023c25282a6970208e1373b0247ddef46da2a576e5cbe537a5df4d5cf4d46493164f4371f154de4aa66900d279823010eeaf5
SSDEEP 49152:Qv+2Q1ipugMbQLU+LFGee9PbDgdVeRVSswyOZWhWbd:Q3Q1ipuHbQ1LFRe9PEVebSswyOZv
TLSH
T16F959E3236E19077D67323319F5C7368B3FCBA700A35469722955E2E2DB0492A93DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftInstrumentationEngine.dll

Path C:\Users\Admin\AppData\Local\Temp\MicrosoftInstrumentationEngine.dll
Size 1.2MB
SHA256 bbc2a9760c849a2b364d8b9834a7eb29f8ba2f297ffe35693ae8a938fce9aacc
MD5 81c91a1ff9e3f864d693ddde686df39a
SHA1 f03a763741f646b0859411a8f6dc380ccc0c5d1a
SHA512 a83b98a7c1bf185808044f1b86f85856f29f4411ba150b9c8a1554b855bba8082ceaf4d60f567911d25391d27ba896012a7faaedc37205518d70753b6719bb62
SSDEEP 24576:BZu+cDVRYMCIfbWYv4UafBlo0esOx1+Ou/I:HTO2CfbWYv4K8I
TLSH
T1BE45841137FC842AF2FB0772697BAA69653BBC5A1B34C4EF5250541E0C39AC59AB0733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SsUCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\SsUCommon.dll
Size 1.7MB
SHA256 73986f828c803903645b1874caf69241a6c8359b122745affcff945a2f508098
MD5 60772f58e9be24b624c40ab156a91dcf
SHA1 dd93acbb162143b8c468b8c1481aff4a5fb36210
SHA512 b147085d3403f3c237bc6f79ccc7047b7b4f3fc32fc5a1aabb6b9d36a258d9b35514510c673ad402d7bf63be5595bde4228319d3c1bf145980fb97bca69c8e17
SSDEEP 49152:WBeMLMozzQKPPTSdp80CUBtHhbj75JMEjxtbTT8rcpn6Ru:GLMozzQWP8p80CUBtH55JMEjxtbTRpn
TLSH
T18585BF22358488B9C52B0331691DB32DA3BDE9718A7545D77FC81FBD3EB1483A638663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\gCjR5\vKcvJFK3Q10\Default\rm5tn3Dx\Login Data
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 493KB
SHA256 7a3d3b2dd5dbc304a1b0536ef0f9a41922e9ce06a25e9914a36d3160ba1f3d40
MD5 a91d604885dfb689678bc1cb5ae1d764
SHA1 3cf32b2eefbaf9bd49b278d8b11840db7cc70b5e
SHA512 d1387d768ff8c78a049880e4b16f57b98a3297048ccc5de3196889f2598e1bb265844f51e293a35c8190aea1b055bbda04e2e97528598a37398a7cdcaf6cf342
SSDEEP 12288:HeMcMmVRYcFERWKn9g82vWirmzbAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sq3a:HeMKYXQKn9g82vtubf03Ooc8dHkC2ecH
TLSH
T1BAB44B332A4109F1E48A23B4618D936283FDED650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

queue4.toml

Path C:\Users\Admin\AppData\Local\Temp\queue4.toml
Size 23KB
SHA256 bfb750e2f362efe2c06cf7b9bfdda3b62e46988e8693078a1ced3a972a8e386d
MD5 23f125cca3b420b00b8fdf142e9a2d0c
SHA1 a7f9b90f31925439485b7ecbb5de18c6dba09565
SHA512 3f029543f4c6cfbde954df67c707becab5069ec3a20cb1fa912fcd7b03c96af0a9f3515e2dc0af17fb9a6c7284f9599f4e585dd9f836ac9fc753fd8689fde923
SSDEEP 384:gNGdXREuG4hmoFy74YdemZsiPysh5Hnu3S+Pxvu0r/jx8zFjcLeJ3VbnuAzP2Ml6:uGdXREAhmoFyUgOazH+9PxGMt8zFcLeu
TLSH
T12EB27DF99A3626567D075D3DCB68E077CB40B2363D0A54B0B6EB08063422BE9D5B0CD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

signal32.conf

Path C:\Users\Admin\AppData\Local\Temp\signal32.conf
Size 9.1MB
SHA256 ec7c75e17305e0229a938ced80342155f97a20bbeb29e8a29751895f6f3db6df
MD5 9ea9bc2e72d36a2816b425d3574af0ed
SHA1 641fbe066884a1c8f627695da5a459e95475f847
SHA512 907de1106d66e4f58e5bcf766aa1a9da5029d5c1bee92938f235c3361ca258fd87148bb6f8239e6562a1f93e12892af2ef9432b5bb2198bdbd7ccb3c2f0f1be2
SSDEEP 98304:d7ft+jbcbW6aVEpHORyoikLy82i82RoKWthtXu0MW32gRvGq1WlU0USUk4jQbxxB:dcsbt21ybirRoKyHpMWpTWmBHHMLRv
TLSH
T192A633946B80ACFAEFD5CCBAD8514A2B61D875BE5334236C674D5028C79F8239D43B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 b59c1f7e457b144a211b74b31492a68a7844232121c4046c7538b0d2ab3cfc31
MD5 6c6c82d1efb4a4f1663b274eb9c33938
SHA1 37ac5fc535269de784ee7a452e5a9bc6ea57798e
SHA512 933d9d109d6dcae8e69b634721a29b963d64330943fddadfd889bbbbd63690fe6beaf35f5d150dd2e29cff89b6379d187cf6a87d8b731c5b68bacdc749859fa2
SSDEEP 24576:/QeCoON4h/4z/G1YknUkY3Ub6lymQmcvIZPoy4yuhp1Rz+:YeCoONs42nUv3Ubftp11+
TLSH
T196358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TurboA128.exe

Path C:\Users\Admin\AppData\Local\TurboA128.exe
Size 227KB
SHA256 0279bed05d51e85b2f94f5f244353e7cca81b48230c06d5ebffce6689d8dccd7
MD5 426d951f2de2d4dfcbe0d1a42bbba72f
SHA1 893f13c568539bec35ef104458894e48b04f098b
SHA512 a03fe479b010bd9c0c13cbc76ea0842a7b7b34f646446b82a983d7aed784ad98d046caaf05a9f3a89cc736ef6123a1616f2116db834f800cc5657c6dab88902a
SSDEEP 3072:wwvk7buUJ+AzBefPgF+pvjOC8XWtpiDR1WgO+sd:wwvk73+4iP6t/DR1
TLSH
T14234194677891899ED7B923FC9938F09A873FC144721D2CF06A4539E1E33BE4AA35361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\NanoCache_win64\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

signal32.conf

Path C:\Users\Admin\AppData\Roaming\NanoCache_win64\OEMJGSCOQTDIN\signal32.conf
Size 3.3MB
SHA256 fa6b5757656e73b89d5151848425a4616559ea5da19bb0e14ac2c1da0a797bec
MD5 49ef8cfd6782d2b6f729592a951a3e4f
SHA1 9fda60288aa9abdbe33b3e6c70787d4d8886b860
SHA512 74196e8503b5dd1fbd099152e44ea4d0312bb0613a13fe9f2ccb17f5cada49513482f0fe8fe76e46302a8673632c9f3ac29d245b944f1093e166ec73c9a6f2aa
SSDEEP 98304:FDYwAVHdWV+e9zCjiU+Mg2rw541lQ7mSLdASujKjChqjC9jTW+HfWZcCw:+wA9WlzCRcL5415SLdARjth5jTb+3w
TLSH
T104F52335DE191EE4E69106FE57172BC399B2BC991933683B5614BC0AF82F8903C27736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EthArray.exe

Path C:\Users\Admin\EthArray.exe
Size 2.0MB
SHA256 f8e409319baa062bbba8bb4114889d7e3dfc5774780aefc57a46f19ff407c18b
MD5 09d7f980ab256ee6f8d1a54109ff4749
SHA1 6a6cf9e5d630346bbfef72fb6b4356bfe33ff589
SHA512 b7a5154f962703de87f9de3e4a3f1742c4f00cb9ccd621142d3d9a343c4f8551dddd0e0ddbe2f18ab48903f8631252517aadad67b0d0169e83d8d187730ba743
SSDEEP 24576:J2PlcPsHsG4YRzktmJu6y72/WQ8ycZ4EM4w8zzoSsCyuiseEwCsDFDYBIP:oRmmJuZ72eQ5cZ4Eu8zXvwbEDQDYBIP
TLSH
T1BDA57D02FF81C877C0260731D89747F967B5FE502F65A69B32943F183E37B909A28666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/776-84-0x0000000074730000-0x000000007477F000-memory.dmp

Download

memory/776-95-0x0000000074730000-0x000000007477F000-memory.dmp

Download

memory/776-81-0x0000000074730000-0x000000007477F000-memory.dmp

Download

memory/776-82-0x00007FFA12880000-0x00007FFA12A89000-memory.dmp

Download

memory/776-118-0x0000000000070000-0x0000000000254000-memory.dmp

Download

memory/1352-120-0x00007FFA12880000-0x00007FFA12A89000-memory.dmp

Download

memory/2112-130-0x00007FFA12880000-0x00007FFA12A89000-memory.dmp

Download

memory/2112-218-0x0000000074730000-0x000000007477F000-memory.dmp

Download

memory/2424-240-0x00000000006D0000-0x0000000000A79000-memory.dmp

Download

memory/2424-358-0x00000000006D0000-0x0000000000A79000-memory.dmp

Download

memory/2424-419-0x00000000006D0000-0x0000000000A79000-memory.dmp

Download

memory/2424-106-0x00007FFA12880000-0x00007FFA12A89000-memory.dmp

Download

memory/2424-97-0x00000000006D0000-0x0000000000A79000-memory.dmp

Download

memory/2424-384-0x00000000006D0000-0x0000000000A79000-memory.dmp

Download

memory/2424-361-0x00000000006D0000-0x0000000000A79000-memory.dmp

Download

memory/2424-455-0x00000000006D0000-0x0000000000A79000-memory.dmp

Download

memory/2424-122-0x00000000006D0000-0x0000000000A79000-memory.dmp

Download

memory/2424-125-0x00000000006D0000-0x0000000000A79000-memory.dmp

Download

memory/2424-334-0x00000000006D0000-0x0000000000A79000-memory.dmp

Download

memory/2484-109-0x00007FF6262D0000-0x00007FF6264FE000-memory.dmp

Download

memory/2484-131-0x00007FF6262D0000-0x00007FF6264FE000-memory.dmp

Download

memory/2484-335-0x00007FF6262D0000-0x00007FF6264FE000-memory.dmp

Download

memory/2484-249-0x00007FF6262D0000-0x00007FF6264FE000-memory.dmp

Download

memory/4452-31-0x00007FFA12880000-0x00007FFA12A89000-memory.dmp

Download

memory/4452-30-0x00000000731F0000-0x000000007323F000-memory.dmp

Download

memory/4624-64-0x0000000074730000-0x000000007477F000-memory.dmp

Download

memory/4624-52-0x0000000074747000-0x0000000074748000-memory.dmp

Download

memory/4624-51-0x00007FFA12880000-0x00007FFA12A89000-memory.dmp

Download

memory/4624-55-0x0000000074730000-0x000000007477F000-memory.dmp

Download

memory/4624-50-0x0000000074730000-0x000000007477F000-memory.dmp

Download

memory/4624-71-0x0000000074730000-0x000000007477F000-memory.dmp

Download

memory/4624-86-0x0000000074730000-0x000000007477F000-memory.dmp

Download

memory/4624-88-0x0000000074747000-0x0000000074748000-memory.dmp

Download