hijackloader | cccaa74eb48cc6152f062bff6416def6922875ff7da6bbd2fac5f75b3332493b

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kythy.exe
Size 13.6MB
Sample260623-pgdzdacw9q
SHA256 cccaa74eb48cc6152f062bff6416def6922875ff7da6bbd2fac5f75b3332493b
MD5 f9faf7b128cbe714fc5fea22fd6fcfca
SHA1 7b98ad093e87167824703d9123c1505c29409a0f
SHA512 b9691a463dc5971fbb8ffaf490e8da67a83e10729271a982a411eab0610876664555240cd3845c6acf6e9bb132f26a8df117ae5702e83eb4dd436f03eb7683cb
SSDEEP 393216:+plz4HwRjPr5O6yRNixxq8yxVT7QhZKQlLkRvf:e6QR0LijqRx97QhZzVkRvf
TLSH
T1D5E63381B7D8ABE5C59AC232CF4BCB535974EB3409682ACBA411FC91CE921F332135E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\advadapter_prod
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c58f-28.dat	family_hijackloader
behavioral2/files/0x000d00000001c5a5-68.dat	family_hijackloader

Suspicious use of NtCreateProcessExOtherParentProcess 25 IoCs

description	pid	Process	procid_target
PID 4256 created 2084	4256	EEngine64.exe	99
PID 4256 created 1072	4256	EEngine64.exe	100
PID 4256 created 1812	4256	EEngine64.exe	101
PID 4256 created 1124	4256	EEngine64.exe	104
PID 4256 created 2100	4256	EEngine64.exe	103
PID 4256 created 5908	4256	EEngine64.exe	105
PID 4256 created 5460	4256	EEngine64.exe	106
PID 4256 created 2752	4256	EEngine64.exe	127
PID 4256 created 2552	4256	EEngine64.exe	128
PID 4256 created 2084	4256	EEngine64.exe	99
PID 4256 created 2084	4256	EEngine64.exe	99
PID 4256 created 1812	4256	EEngine64.exe	101
PID 4256 created 1812	4256	EEngine64.exe	101
PID 4256 created 1624	4256	EEngine64.exe	132
PID 4256 created 3680	4256	EEngine64.exe	133
PID 4256 created 4680	4256	EEngine64.exe	136
PID 4256 created 5448	4256	EEngine64.exe	135
PID 4256 created 3624	4256	EEngine64.exe	137
PID 4256 created 2828	4256	EEngine64.exe	139
PID 4256 created 240	4256	EEngine64.exe	140
PID 4256 created 5328	4256	EEngine64.exe	141
PID 4256 created 1624	4256	EEngine64.exe	132
PID 4256 created 1624	4256	EEngine64.exe	132
PID 4256 created 4680	4256	EEngine64.exe	136
PID 4256 created 4680	4256	EEngine64.exe	136

Executes dropped EXE 3 IoCs

pid	Process
5936	ChiInf.exe
3544	ChiInf.exe
564	ChiInf.exe

Loads dropped DLL 7 IoCs

pid	Process
5936	ChiInf.exe
3544	ChiInf.exe
564	ChiInf.exe
4788	ParallelCom.exe
4256	EEngine64.exe
5788	Crisp.exe
5964	Crisp.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4256	EEngine64.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 564 set thread context of 4788	564	ChiInf.exe	91
PID 3544 set thread context of 4256	3544	ChiInf.exe	92
PID 564 set thread context of 5788	564	ChiInf.exe	93
PID 3544 set thread context of 5964	3544	ChiInf.exe	94
PID 4788 set thread context of 2084	4788	ParallelCom.exe	99
PID 4788 set thread context of 968	4788	ParallelCom.exe	129
PID 4788 set thread context of 2084	4788	ParallelCom.exe	99
PID 4788 set thread context of 6616	4788	ParallelCom.exe	150

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	ParallelCom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	ParallelCom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	ParallelCom.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	ParallelCom.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\NOTICE.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	ParallelCom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	ParallelCom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	ParallelCom.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Tasks\HandlerControl_v3.job	Crisp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kythy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ParallelCom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1812	chrome.exe
4680	msedge.exe
2256	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EEngine64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EEngine64.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266907196865257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4788	ParallelCom.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5936	ChiInf.exe
3544	ChiInf.exe
3544	ChiInf.exe
564	ChiInf.exe
564	ChiInf.exe
564	ChiInf.exe
564	ChiInf.exe
3544	ChiInf.exe
3544	ChiInf.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
5788	Crisp.exe
5788	Crisp.exe
5788	Crisp.exe
5788	Crisp.exe
5788	Crisp.exe
5788	Crisp.exe
5788	Crisp.exe
5788	Crisp.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4256	EEngine64.exe
4256	EEngine64.exe
4256	EEngine64.exe
4256	EEngine64.exe
4256	EEngine64.exe
4256	EEngine64.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
2084	chrome.exe
2084	chrome.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
5964	Crisp.exe
5964	Crisp.exe
5964	Crisp.exe
5964	Crisp.exe
5964	Crisp.exe
5964	Crisp.exe
5964	Crisp.exe
5964	Crisp.exe
5964	Crisp.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4788	ParallelCom.exe
4256	EEngine64.exe
4256	EEngine64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4788	ParallelCom.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
564	ChiInf.exe
3544	ChiInf.exe
564	ChiInf.exe
3544	ChiInf.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4788	ParallelCom.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeDebugPrivilege	4256	EEngine64.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeDebugPrivilege	4788	ParallelCom.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeDebugPrivilege	4788	ParallelCom.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 5936	4840	kythy.exe	88
PID 5936 wrote to memory of 3544	5936	ChiInf.exe	89
PID 3544 wrote to memory of 564	3544	ChiInf.exe	90
PID 564 wrote to memory of 4788	564	ChiInf.exe	91
PID 564 wrote to memory of 4788	564	ChiInf.exe	91
PID 3544 wrote to memory of 4256	3544	ChiInf.exe	92
PID 3544 wrote to memory of 4256	3544	ChiInf.exe	92
PID 564 wrote to memory of 5788	564	ChiInf.exe	93
PID 3544 wrote to memory of 5964	3544	ChiInf.exe	94
PID 564 wrote to memory of 5788	564	ChiInf.exe	93
PID 3544 wrote to memory of 5964	3544	ChiInf.exe	94
PID 2084 wrote to memory of 1072	2084	chrome.exe	100
PID 2084 wrote to memory of 1812	2084	chrome.exe	101
PID 2084 wrote to memory of 2100	2084	chrome.exe	103
PID 2084 wrote to memory of 2100	2084	chrome.exe	103
PID 2084 wrote to memory of 5460	2084	chrome.exe	106
PID 2084 wrote to memory of 5908	2084	chrome.exe	105
PID 2084 wrote to memory of 5460	2084	chrome.exe	106
PID 2084 wrote to memory of 5908	2084	chrome.exe	105
PID 2084 wrote to memory of 1124	2084	chrome.exe	104
PID 2084 wrote to memory of 1124	2084	chrome.exe	104
PID 2084 wrote to memory of 2004	2084	chrome.exe	107
PID 2084 wrote to memory of 2004	2084	chrome.exe	107
PID 2084 wrote to memory of 2104	2084	chrome.exe	108
PID 2084 wrote to memory of 2104	2084	chrome.exe	108
PID 2084 wrote to memory of 5332	2084	chrome.exe	109
PID 2084 wrote to memory of 5332	2084	chrome.exe	109
PID 2084 wrote to memory of 2396	2084	chrome.exe	110
PID 2084 wrote to memory of 2396	2084	chrome.exe	110
PID 4788 wrote to memory of 2084	4788	ParallelCom.exe	99
PID 4788 wrote to memory of 2084	4788	ParallelCom.exe	99
PID 4788 wrote to memory of 2084	4788	ParallelCom.exe	99
PID 4788 wrote to memory of 2084	4788	ParallelCom.exe	99
PID 4788 wrote to memory of 2084	4788	ParallelCom.exe	99
PID 2084 wrote to memory of 1256	2084	chrome.exe	111
PID 2084 wrote to memory of 1396	2084	chrome.exe	113
PID 2084 wrote to memory of 1396	2084	chrome.exe	113
PID 2084 wrote to memory of 3380	2084	chrome.exe	114
PID 2084 wrote to memory of 3380	2084	chrome.exe	114
PID 2084 wrote to memory of 4496	2084	chrome.exe	118
PID 2084 wrote to memory of 4496	2084	chrome.exe	118
PID 2084 wrote to memory of 5348	2084	chrome.exe	119
PID 2084 wrote to memory of 5348	2084	chrome.exe	119
PID 2084 wrote to memory of 404	2084	chrome.exe	120
PID 2084 wrote to memory of 2704	2084	chrome.exe	121
PID 2084 wrote to memory of 404	2084	chrome.exe	120
PID 2084 wrote to memory of 4176	2084	chrome.exe	122
PID 2084 wrote to memory of 2704	2084	chrome.exe	121
PID 2084 wrote to memory of 4176	2084	chrome.exe	122
PID 2084 wrote to memory of 4968	2084	chrome.exe	123
PID 2084 wrote to memory of 1092	2084	chrome.exe	124
PID 2084 wrote to memory of 4968	2084	chrome.exe	123
PID 2084 wrote to memory of 1592	2084	chrome.exe	125
PID 2084 wrote to memory of 1092	2084	chrome.exe	124
PID 2084 wrote to memory of 1592	2084	chrome.exe	125
PID 2084 wrote to memory of 6140	2084	chrome.exe	126
PID 2084 wrote to memory of 6140	2084	chrome.exe	126
PID 2084 wrote to memory of 2752	2084	chrome.exe	127
PID 2084 wrote to memory of 2752	2084	chrome.exe	127
PID 2084 wrote to memory of 2552	2084	chrome.exe	128
PID 2084 wrote to memory of 2552	2084	chrome.exe	128
PID 4788 wrote to memory of 968	4788	ParallelCom.exe	129
PID 4788 wrote to memory of 968	4788	ParallelCom.exe	129
PID 4788 wrote to memory of 968	4788	ParallelCom.exe	129

C:\Users\Admin\AppData\Local\Temp\kythy.exe
"C:\Users\Admin\AppData\Local\Temp\kythy.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\ChiInf.exe
  "C:\Users\Admin\AppData\Local\Temp\ChiInf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\ProgramData\advadapter_prod\ChiInf.exe
    C:\ProgramData\advadapter_prod\ChiInf.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Users\Admin\AppData\Roaming\advadapter_prod\VWLVJHBOBIQWNBLHDO\ChiInf.exe
      C:\Users\Admin\AppData\Roaming\advadapter_prod\VWLVJHBOBIQWNBLHDO\ChiInf.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\Users\Admin\AppData\Local\Temp\ParallelCom.exe
        
        C:\Users\Admin\AppData\Local\Temp\ParallelCom.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4788
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:968
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Roaming\MSFTWatch\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\MSFTWatch\Crisp.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\EEngine64.exe
      C:\Users\Admin\AppData\Local\EEngine64.exe
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:1624
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fffddfcc188,0x7fffddfcc194,0x7fffddfcc1a0
        6⤵
        
        PID:3680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1568,i,3722056378024785854,6618601450251491964,262144 --field-trial-handle=2584,i,3574110623222512791,10456824199651842845,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
        6⤵
        
        PID:5448
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,11824081387487363121,3069409725257552914,524288 --field-trial-handle=2584,i,3574110623222512791,10456824199651842845,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:4680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,6316624121007097769,2032557151066114562,524288 --field-trial-handle=2584,i,3574110623222512791,10456824199651842845,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:13
        6⤵
        
        PID:3624
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3252,i,3815588395976131463,1082807017213961643,2097152 --field-trial-handle=2584,i,3574110623222512791,10456824199651842845,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        6⤵
        
        PID:3396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3248,i,4963224945806809160,2490103420638841529,2097152 --field-trial-handle=2584,i,3574110623222512791,10456824199651842845,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        6⤵
        
        PID:2828
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4072,i,7051319722666682948,17891515776063340416,2097152 --field-trial-handle=2584,i,3574110623222512791,10456824199651842845,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
        6⤵
        
        PID:240
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=2900,i,14467933681875332121,4949324705355921803,2097152 --field-trial-handle=2584,i,3574110623222512791,10456824199651842845,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
        6⤵
        
        PID:5328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,6742514238945260395,5836760202699829448,524288 --field-trial-handle=2584,i,3574110623222512791,10456824199651842845,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
        6⤵
        
        PID:6452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,5944161583174902851,2311741779127870983,524288 --field-trial-handle=2584,i,3574110623222512791,10456824199651842845,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
        6⤵
        
        PID:7080
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,7197612083154422532,583341530889690604,524288 --field-trial-handle=2584,i,3574110623222512791,10456824199651842845,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
        6⤵
        
        PID:7088
  - - C:\Users\Admin\AppData\Roaming\advadapter_prod\Crisp.exe
      C:\Users\Admin\AppData\Roaming\advadapter_prod\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:5540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffe33cc728,0x7fffe33cc734,0x7fffe33cc740
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,8182095105074780661,13388852313329657788,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,17617594442700670238,17373993955998171165,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:13
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,2141644314978237457,17703555490110884687,262144 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3100,i,10481971805011928496,11543472312081705152,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,1937631587645316361,3885197614180425634,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4624,i,17385554769390709610,5664086581014821567,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,4619160279582962728,18366605603572678389,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4972,i,1643610911518595388,9105979862842628919,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5128,i,8984403962123300551,13515019385403301086,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,14150925436386371071,16445340731182205664,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5404,i,16813425550759578268,16039566931366673166,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5444,i,15334395636203097736,3372470593131523436,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5484,i,2659429877426830861,12174925684094909614,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6288,i,16106427525572995026,12357922952475788277,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6440,i,7197950428455116211,3936549724382454617,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,8010656362706374345,9534371798930286940,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5684,i,6494001222837314456,14068761823004085302,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,5824148517774369290,105520057157892258,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6052,i,3667899870232726076,16230203576082218931,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6396,i,16732888387361101153,17556779702852027849,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,125785488361022579,10921246514816493075,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4720,i,13236907403431354989,9161795629971889291,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:9
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4696,i,5748967524283680641,8752826996423195893,2097152 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,8515225635862065341,15321100414711573100,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
  2⤵
  PID:6356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6436,i,2547249752674088353,6407565663592274673,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
  2⤵
  PID:6360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,2790640070784585016,1160340114220687590,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,12856933292439471758,2158246289849799174,524288 --field-trial-handle=2016,i,5922650297186890140,1108141966069775029,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:620

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EEngine64.exe

Path C:\Users\Admin\AppData\Local\EEngine64.exe
Size 66KB
SHA256 57ec97f531753ff2c825eabb56134754d0a7c1edb606d278ccbcb8506b5a5a6c
MD5 c4b2fa1093afb112016ac238117dda55
SHA1 398d6f2cb9ec3ea2047d930a0cb187edfcff5a17
SHA512 66003643bd95b868c5fe3ce08a661b3a4a4dff698079aebbe6de2f529a74195c7bd3102b0f785cc6dfc47c6b173a9d2deeb6199ff9624aa83920efae67778623
SSDEEP 768:nntBs+7ClZE/rCZodTIwDlI6WJ3NTzDcEc05YpX+kDpvy+uLzK322YR2TkKpV1V5:s+hIodTxI6WnYE7YVnyNzK4UVpP0Xe
TLSH
T117636D47277400F6E7978E75C8F19D06EE73F88267FA518F025882561F823D1AE6933A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 95f0f4a12026aedf330961f31dc89f8151369604d6bc16726fd43345f25d49f0
MD5 2e6df90526eaa9744d77008668dd0208
SHA1 c1b10743d1139823d7f4aef81c263bd24314226f
SHA512 2716c458fd14ae8f3d809ca9dbad50d20f827e034a8a6c70e7ec87c30edf4a0cf9def74b0c1aa96436d2f769db358b20dc0b73fffb0a031bbff865de1e8f8845
TLSH
T1C85179B7D7D4867D841166E4AA21AA2BCD2A0E18532C3C5688D8AF4B57E2973D31036E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 1550c6499e0221caaf979e76325bf1e8b5cb482092ca0dffa50b2ad428656136
MD5 2cfa0f3f08204666a864f71ea08c067f
SHA1 a63cae074a5c60daae7f309d5a79796d01ef8ce3
SHA512 3e6abed8ae37bfc2e7d68dfda83ccdc32ce1e6b95b9a9f9c334aaaaced3d00935f7dec2902682bc990758ac070c9d383fe6e8206f71e65d92654530be4ff340d
SSDEEP 192:SRzmCz1L+pv7XAPRp2O9mHsb+WNnUIz0hmte0VyIsnAUgR:SRqsKpuXFQw702R
TLSH
T12322872EAA20A53B5CCBD619FA71BB53D3F5102135D02E84E7FC8A6C51E79CD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fe6f59eb75e2175becc50ea8227ae3f82834b48ea9a41eaf262042a73ec8e4c8
MD5 b05298b63d918351697fedcd42142702
SHA1 7655ecef20c041c6011da0b37c67a06796850a92
SHA512 9ed295d05c13de2d5dd30442d2e7bd0662e52c31dad02849580e1536c8feef8fed76b32bdd6376a426a9531f1e42303a135598e7add011b3c2d08e08cffe42be
SSDEEP 192:SRzmCz1L+pv7XMPRpKO9mHsb+WNnUIz0h8texVyIsnAUgE:SRqsKpaXBQw70bE
TLSH
T19632982EAA10A53B5CCBD759F965BB63D2F5102131D02E84E7FCCA6C15EB9CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 d81e34c690a4a5257b710afc43198a2ca1e48abb124095c7a3b48fc6aa65acec
MD5 9736142eea35abda036de682f57d619e
SHA1 5fe2b2345755ea11a0bf641d9c510a8a159e83b2
SHA512 250e7fab64b275774649e43e6611e86b595f9bdf9ec3d21564b11bfbf9376979bf41d4ca210984308701bf21e7abbf84c72aa7214f29f2536f69321b639de84b
SSDEEP 192:e8z4K66Q7KxkXqK4I40pUZNCgVLHrKHfFKslEx0kSXzKD/tQ+ErUkKN94o8CUXp9:ZzjlQ7KxkXqKf/pUZNCgVLH2HfgslcPa
TLSH
T17C32D827A58D9A7F0FD8E90DCC536F8B6DB5019676680C24A2FF9D0403A57CA110E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 1ac1f25db92b8a6f5ad78f41c473107b65c61722483d88d4a0a15e7e76aaec5e
MD5 2bb42c8fd3405dd637166d8c30d2b0a4
SHA1 41a6832cf382e08b71551f9d5b5fe594630c5066
SHA512 3d2645e363fa4a5ed81a725cfd31fd4ed5479f38e9ef0017693b46ce59514ec46b3709a885a3dee335b93f540a44c782dd20f44123898caf6e45bd89b7647653
TLSH
T1D5A0021482C10519CD004B766061354123B149185E5947075496094CAF9B1C04502A22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e209.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59e209.TMP
Size 48B
SHA256 f7636e24d63e63d662fe46c71aa281c337f040d15a02de17235bd1d71923c335
MD5 d80bfb32054d854a6e4148bcf6200c44
SHA1 8f86831c998102ec5e16cfd20518adf3621f36f1
SHA512 8619209615c8fec0e34bdb108909e47e21128df003a9eac29f54178b4913e598b05757dc65525b6e9038af656f7a8bcd6371aff68825096246808dfdbc496ee9
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 822b98fbf61560b261712cd78b9201e5ce71dc1237b98c2e7b74048117a09df7
MD5 847d584d824c20e21f8ad378945e64be
SHA1 595034663df49e063997cd6e9289e28a99b071d8
SHA512 ad95c8b7281a7fbfac0a99b0c6a34605bc77f92b03c4239ac0c64239c247e31ac91af8840835bcf84f9df37cb2ee03617ac989e803874997e65c6d0ec53b1b01
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OZQ2VumVnPE:1nbZeMrv/hGtZQonM
TLSH
T19AD3974B3A743002EDE59A725CE050BF5D3CB16D4F56A5D428B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 af31a74c05b6eadb5d0a5f7f865b64f031ed0b1738836ae34164eb26f6c6f5ea
MD5 1836ae1e7f9380d7f7ef218c1e037399
SHA1 0271278d8ed192029db8ebe6ebcf7d335a8239d1
SHA512 97788056735085509693d11193fbd7b88498e553de27639e9cbb2c4c472ddb0c5cace46cc3c955efa0a80c994d34a2816ef394e79dadf59ff82eff3352eb38b7
SSDEEP 3072:tEEnKeJCYq/wKO6P57qSHFtPDsgYM8wCHui/Pdm2ETgPgF:tEEKqCYq4k57jPDeECHu8PHETgPQ
TLSH
T1D1C312B1BE622E793DA3993012F72F034FCAA0DB1A61FFC5B55129071A436CD4A16253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 6e01324604dc5576d0a20fedf8f8a849fe930369e6b0833b5b0fef90dcfb3960
MD5 0c449f4fabe9f1d59646a9294033851c
SHA1 f910741413e77c47a0d5793f62a64b2c2359b784
SHA512 17002d112aeb6943864b9efb605ad0a231fa1ea8609a15c325572266afe56ed94dfc9ce3c45d5f723810a72dafbf88ff2f26c8e698481d91018767b99fffd64c
SSDEEP 3072:tS3EnKeJCYq/wKO6P57qSHFtPDsgYM8wCHui/Pdm2ETgPgF:tMEKqCYq4k57jPDeECHu8PHETgPQ
TLSH
T12CC313A0FF622E353DA3E93052F72B078F8A60D95572EFC2B296250757835CD4726253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 63d20e3b36bf5cb2329edd80136db5f769b5a8c9871942e5b74bbf9ed520291f
MD5 09b78ecd28bc18a2eacb92a51318cf95
SHA1 e643d3bf93f8cf93b78d5bf3e22c0859037d6c87
SHA512 0f62d4811553e1479223acf42b35a5d75ffd84dc5e1cad08ccfa4fdc86f08caeef3b5c0051b15c513f05b951f85bc44c8c6c1747570698ba1c892556c05301b0
SSDEEP 96:4C6Wd+kaO2Zqk3kfIbEOERDotok5YvDtmB6iGyv0mEEshfmbx4+v4a:4ChPGZqk3fYNDUDut2WmErhfmbx4g
TLSH
T125A11A32647ECDB39471E9C6B5422F03CEA86067A5929FC4E9ED4F0C20A70ED1346627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 44a41b6b64986872f6db85f3991cb99510d6b51af8553bb5a9f926023bdd297f
MD5 0e4dac129a68aa7e6d5112798a47e559
SHA1 93d062cf30737aa8a08234745168873d3aa22303
SHA512 b596cdd3d5ab2bb43a9b1feeb80a8148c2dede5027351917054908a6b12eaffaaf74fdaa0169fd3f70317fd51f43163360fc284f087ff78b25ce427975479c63
SSDEEP 3072:wV3EnKeJCYq/wKO6P57qSHFtPDsgYM8wCHui/Pdm2ETgPgF:w9EKqCYq4k57jPDeECHu8PHETgPQ
TLSH
T1DAC313A0FF622E353DA3D93052F72B078F8A60D55572EFC2B29625075B835CD4726253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 eb4692e34bf8983af0d9d96549d0a35cdf7c841c41e00640d86ef5e3f314680a
MD5 03163acca50079a286415957113e007f
SHA1 7109124b16665ed0ee075d6c2e8fa33cc272cb76
SHA512 d605514acfbc81c0754b0bfff70c1000353e694b142df8c03f9183e923f1492927df2ee1c487c4cdc9cd69873d2d5bfc1f957a4a354ac88eca0bc9097cce6e7a
SSDEEP 384:DNrRZyCSDnxTICiPMEhIKyll7svbFKfk7:xFZJSDnilEyI1l7svbF9
TLSH
T14844740A7B747001EDE6D9725CB080771E3CB16D8F22A6D16DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 66f1621c64ae19440341127ce97629fffba50dfecfad3c7380dbe1594b07f0a7
MD5 f2159b1763afc628520f6922c79a1ce5
SHA1 750aa8137e71fb68e495c3ccfe75bc24b2f0bd8e
SHA512 b48180e163c4a5b0c86801877dff6b617f0e17c7003c31026d62ef197040250b3a79efccb376a233360a3528b87ee38d9ed06df9e8544dc2d2b2ac42ee766453
SSDEEP 768:3jaeqD4MlshiLdMmf3KpfyEffyuA7NpespIRM0UmkTziwjgzG5nApXLPQTU:3qcjhIdMo3EfjfeQsZ0UmYRnKXD
TLSH
T1AC03CF36D8605EB78CB6E68A264776576FB00293C2C43BC8CCED6E0D42876DD530786B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

147.0.3912.60.manifest

Path C:\Users\Admin\AppData\Local\Temp\147.0.3912.60.manifest
Size 226B
SHA256 9d8d052203be7dc0c4cffbdfe96bbb2b8b051b952981454b783a81153c980ef1
MD5 b021a73dc97b62ccd8aaa7289c4465e2
SHA1 7357804885e92453fbb3aebee78850cd34d87bfe
SHA512 4dee055d64bcd9b017eed136f20e6ea16f2b85b42906c8be6aa5a4de7d3038c43841444b034a77710e6f5c969be1eee04bbe65b587dac72f9bccf43878adf25e
TLSH
T15ED02340C0C1734DBB3250543C797505422DC7B344CC111D30FC7917AB5351491439F0
MD5 SHA1 SHA512 TLSH

Submit Download

74523426

Path C:\Users\Admin\AppData\Local\Temp\156d9783\74523426
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1F6289.tmp

Path C:\Users\Admin\AppData\Local\Temp\1F6289.tmp
Size 40B
SHA256 55ec49337d77a26e4c82359aa0d2af9307e3210ba3249e0b424dfe53c2e7069d
MD5 26eb12dade463302e55cb46b189529a3
SHA1 7cf84e18aef851ed40e1a36bca9bf9f64afec3c5
SHA512 266e091b7a3a3ee2e225b2fc1c8203bec43e1160050989d221606d976771771b2e2dd3d4f5277dc29c4cdb00257decfde5b2e4939249b8d48acabf54e19c1019
MD5 SHA1 SHA512

Submit Download

38512D4.tmp

Path C:\Users\Admin\AppData\Local\Temp\38512D4.tmp
Size 40B
SHA256 f8e72251b3410326b2424b028d23b2aaa2ef1d5e67e1f1859b1d851a3059964e
MD5 6299ef84de674e2457dc6645083e9fb4
SHA1 dc43111724c2108129677dcf9f9618e44072964e
SHA512 b409391a5ea1721887cc65ab4e52a3d123f243b380a81245fa06d52823dd57a9e2794613943e38a4fb64975ee5e6b84fd818e528deabca10bea6c7c5f39f282e
MD5 SHA1 SHA512

Submit Download

ChiInf.exe

Path C:\Users\Admin\AppData\Local\Temp\ChiInf.exe
Size 4.4MB
SHA256 cc13554c470a3c49c333470fac60325fc01ca011055df5a71fd9b8ac0395ed4e
MD5 3dab8d550ca2906c6c6048a9b187db11
SHA1 ec49beaf109ea11b680ae1ae8d9e3a69c85a618f
SHA512 814591014986709b05f6618eb5bca4a35b33d7f883c0d8b7e9bf2374b801cbce122ca27950ea022e92caa561159a409516b3965c679ec2c567e0fa499cbd16f3
SSDEEP 49152:j39nxtCtoHPDD9x2GkEMpTJkSDmLmHQaePPa+FRZN23P0aDwiGyshNnNnw4leJti:Ksv9GVIV3Q3lGRZYdPgL5f8Dbc
TLSH
T1C8265A03E19511D8C05DC179CF4A8222ABA5BC494BF266EF2A50B7D12E76EE47B3F710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D09CEE4.tmp

Path C:\Users\Admin\AppData\Local\Temp\D09CEE4.tmp
Size 15.8MB
SHA256 c3c5602eeda316c6fc9e29bc497db4553651a5f02a8702f1b5ef3b6ebc020d6e
MD5 209fb2bc23c17c8467797089f764ad48
SHA1 ac4e4ae648e2cabf621800496e4f84511bddb5c6
SHA512 351d9a9ced86f0f12fb92770b8f33d36650c8d5e56a661bf50b69958511f187c63f40d032a0b30bca48103f01338c9e02bac2396c0f30ffd9110fc2199746983
SSDEEP 393216:O8acw+AtQ9NjY5diV9Wmjgobbvy8ZDepreRKbBaPjGqjNgqSfKz8p/N0pCm:XajPS95rLgUvRepqUXqxnSvN7m
TLSH
T176F6330F54E3469BD62F87EAD106E1D5EE058229C0B1DA12ADF53860F166ABFD80CF85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D09CEE4.tmp

Path C:\Users\Admin\AppData\Local\Temp\D09CEE4.tmp
Size 15.8MB
SHA256 90b7890f5800f45294d521d8e5b66f52c8b6c9caaa35a2a01e11a54ce12921e2
MD5 b436f290799ac7bd01990e241228f4fb
SHA1 ce1e9d41d772b0973acf3a51a7ec4638a5f52092
SHA512 0857887791ba5fb0e1d4df4d2db4e1e6e39326ddde72b69f54b048b7ed6048cf06d2cb1a1c57d918f0bf35738c8346c72678baeddbf7e79307d84e1b62c96cac
SSDEEP 393216:Dgacw+AtQ9NjY5diV9Wmjgobbvy8ZDepreRKbBaPjGqjNgqSfKz8p/N0pCm:kajPS95rLgUvRepqUXqxnSvN7m
TLSH
T15AF6330F54E3469BD62F87EAD106E1D5EE058229C0B1DA12ADF53860F166ABFDC0CF85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D9AD4CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\D9AD4CF.tmp
Size 4.6MB
SHA256 2dca848b758e69741f7a351dde550782758447bb614cb4071a1cc1d2a018ff31
MD5 670aa0f7cb4c31fac83a45c24753bedb
SHA1 85272a8ae5378f87d85e731059447da194cfcf38
SHA512 1d6eaf5a17d1a3192bf2bf3b15749308a403ea00cbb582ecd4379b6c5a548d037122c9d31a43fc72f2d7bd1cf5406beec29f3a8341816845dd2a037f70062b3c
SSDEEP 98304:5uC85hzoVxaY2+ptTi/quwOTCsdIBukYWWpNkwjwr6TN8yalxanK:98uxaMTMwO/IBukluNkw8rUWlMK
TLSH
T1E9263321F264DA6F41BEACE13BC3B3DF17625136756F2D440AB188B655330E64E6BC88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D9AD4CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\D9AD4CF.tmp
Size 4.6MB
SHA256 42c077176e6fce9471f9647318fe3ba397fbfc0155d218a2c55ce773203734fa
MD5 5cdec45e8cab32114b6dc6a18a17f3bc
SHA1 af9105037b8069cf57b3a707cdb3b00bebe17b20
SHA512 c0c781eab6c51ac19feb029201e469605222dd83d44ecf7a1e3eda95ade0c594bfe6c37d9274023e0124ed14e99037fd607f085581eb7a0b1b8e46dcacc6afba
SSDEEP 98304:SuC85hUoVxaY2+ptTi/quwOTCsdIBukYWWpNkwjwr6TN8yalxanK:onuxaMTMwO/IBukluNkw8rUWlMK
TLSH
T170263321F264DA6F41BEACE13BC3B3DF17625136756F2D440AB188B655330E64E6BC88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Givk3.7z

Path C:\Users\Admin\AppData\Local\Temp\Givk3.7z
Size 18KB
SHA256 8131abb6089a63526dd0d60f61338cb0af538d0d9da00004b335937b83e4ce8e
MD5 9692306a20f6b3efa8eafd1d019efd51
SHA1 0f2314d77b76705fa1e8dc2c7735fb1a635c098d
SHA512 120f77864b729cad764495da79bf5f11eba46ab82966acde9028c3d0cac7acef7018bc5c5bea226b246902689f81bdb2dbf184d635bf17856661339fa51455d5
SSDEEP 384:7hoKS/rt2LbLu4ULHRoxmsY+q1ScSHj1UU/N4/YPOOLpasPr4:dm0LXu4CHOsohj1Uy3dD4
TLSH
T1CD92C19B4681E09150C01E31F0435B68FA47509FBA49788AEB731C2767EF394DA342B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ParallelCom.exe

Path C:\Users\Admin\AppData\Local\Temp\ParallelCom.exe
Size 2.3MB
SHA256 c594d3875bdc99625d12ce534e4ae17c38a17647f243f9463089eac68da96e8f
MD5 6439baab2c61892fc2669b4322d7cc71
SHA1 8daf55a68296bc322e62a0aacbe819ea22470638
SHA512 a76da2664b07208d51b5567fc48eb595b7d6cc2c46602386046cd3306a1b145e7959da9ca2e5e9932a514ccc0e3291562c48ab871b2c3a416c3180a06d29137b
SSDEEP 49152:lzfHoM2UyTx0TPb3mazHOu8YADoFPDHH8ZncCowD:20Tj3mazHMD2C
TLSH
T1E6B57D91BBD881E9C783057680A7B71FA233A793371DD5C3E6942E4969306D3BC3E219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audioopt.idx

Path C:\Users\Admin\AppData\Local\Temp\audioopt.idx
Size 21KB
SHA256 490b0d884285c6a4dc21c7fa31b4aba7abe219e3ed572f08af200b653c2caf0a
MD5 3e143d8d3b35eabd76322418c1ec1848
SHA1 fbea1bb45d20d0bb6a2a5211241722119a5e8db2
SHA512 2ef0270e249484c170adfdf251978746233ae193d656bfd347b4b72c1f6a615e09297723b2cfce2d71652a382af3e8bb99a864b7caacc140578385064fb0f373
SSDEEP 384:nnHj3/TJ1PbikhvtThqCRjAuIpGWP9Spp4FDDpaSqRfnk7Iw1rOkUZCBy4tMa:nD3rLJ5hq20v9Spp4hDQSAnw/JBttMa
TLSH
T143A26C7ABD26162DD02BF459A9109296CBECB5BD3FCF2161248A8F15741FEB6C050C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

channel-eng.bin

Path C:\Users\Admin\AppData\Local\Temp\channel-eng.bin
Size 11.6MB
SHA256 a54c00c32f98e534bdc0c9a5531cee619e836ebdf98df2d6e00810035e8bb31a
MD5 c22def2dbde251da20b208e5a19d2cbc
SHA1 791e14b6ef56023d5e075a12cf6fa6711896a8d6
SHA512 7e292a74668f8c4bbaadbe01f6d62e32df489a4126c8c17b3d9389a06f7f2c60963ab2238adf62975d3d8cb076c2408ed2439a540028f46657e5953ee70f1e41
SSDEEP 196608:tVZQsoafWQKMWBO9ofoWjBSl1AcLVku4ZEwD5fe68sC3kRVAdZ/kptICPyN3+kO3:tVZwMKMx9QoWNSOcLVsZEE5e68sCuu/c
TLSH
T1A8C633646DCFEEA9ED315DF2C2A57C587502A0081FA21DFD04C3D3C9492A2C5A259BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_elf.dll

Path C:\Users\Admin\AppData\Local\Temp\msedge_elf.dll
Size 4.6MB
SHA256 18d9430c213dfbbec1f474c203af0e6451d0010c70460ec5d7888d7a0b32c29d
MD5 f5fffcda6a6678d9087f6748e05457c7
SHA1 1ad5ac2b2a58234c2476ab870024eae7a6ccd2ac
SHA512 b471f8a98d9d220140111d8669f76f7b168776161bccdf187b896fba73dcbfc114255f969767db17ae23f9362ad87ae6eeea6c52cbc036060c673d3a799f3159
SSDEEP 49152:AvpymuuYv8aN7T44cEMPAhY+ZtmIRrKo6Ka1nLSfdS84piOOp9P/CHZ6fbT/6IFE:KYkuTHXOoflAkRjkGg
TLSH
T19C263A83E26211A9C40ED874CF2E552297247C4A47F1A3FF29E876E11A75BC9773DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

passkey_authenticator_plugin.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\passkey_authenticator_plugin.exe.manifest
Size 1KB
SHA256 18fd5f38e38ae47d6749b8a47aead0c000c3af506a57113e5916c6a3bddb43c2
MD5 d2ca2f5bb6832b5a0a5a1dc8f30cbdcf
SHA1 3d7f9b9961b8b2c5eae8880ad0c18be3d3b86390
SHA512 812fe59349226030c6b2e043cb87202b2a0ca23edc9296b3de08bd70f2ee20deb34ad243be318293694061d02b4e524ebad903122eb85e8258905f27ad02bdf0
TLSH
T1B421E391C0D4E651E63200C73660F844EE2D977F4ECE8AA8708DDBDB5F27981C643161
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2084_916240672\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.3MB
SHA256 2c08e77f86b0953cffa505bdbe64e87ecb7c088db65d5acb9a2eee65a32565ef
MD5 81a08ea850a35a5efcfe54864a51cf6d
SHA1 8089a77adeb65f6402d2c6fc2cb76d7bbf102e10
SHA512 7cd65985cea38c3e1b8b2308da5ea6d52c657ad259edac47ebcb23d9f54df868ab3571ac25de12b8e9b52abc0711cce68f94b811445226364f998384b72950f3
SSDEEP 24576:W9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8JszORmxvSZX0ypapJDBHd:W9KpUmTfFqSgdDPq3DjqI08LupJDT
TLSH
T1FE55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\MSFTWatch\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

channel-eng.bin

Path C:\Users\Admin\AppData\Roaming\advadapter_prod\VWLVJHBOBIQWNBLHDO\channel-eng.bin
Size 3.6MB
SHA256 35d39e6c269bd87f09af798ad588c418db1cfa20fd4579e353928cef4f5cd89b
MD5 0c70a23739a890f0fb30bbdf837a19ba
SHA1 ecf55054602d824e94cbe82c691ecaf4360e97a6
SHA512 b064ac029978fa13739053726a54dd5032a505e5b37a36ff885933142eb901030e4f2def819dc64d5e608c20f4d3a559e392fcd59a6358264d01a0f9079ca102
SSDEEP 98304:/sy8GSRgOPSF5ka5QbdWbcGSNnIluZ43B8IHl1V:YpgOPNSt0Jz4a6l1V
TLSH
T1330633E182E94F35D54DE7E6B988C1DF54213E7F1B0A36B362B2DCFA0DAD4628214394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-90-0x00007FF6C8050000-0x00007FF6C84C6000-memory.dmp

Download

memory/564-78-0x00007FFFFD8F0000-0x00007FFFFD953000-memory.dmp

Download

memory/564-71-0x00007FFFFD8F0000-0x00007FFFFD953000-memory.dmp

Download

memory/564-69-0x00007FFFFD8F0000-0x00007FFFFD953000-memory.dmp

Download

memory/3544-73-0x00007FFFFD8F0000-0x00007FFFFD953000-memory.dmp

Download

memory/3544-48-0x00007FFFFD8F0000-0x00007FFFFD953000-memory.dmp

Download

memory/3544-38-0x00007FFFFD8F0000-0x00007FFFFD953000-memory.dmp

Download

memory/3544-45-0x00007FFFFD90D000-0x00007FFFFD90F000-memory.dmp

Download

memory/3544-49-0x00007FFFFD8F0000-0x00007FFFFD953000-memory.dmp

Download

memory/3544-62-0x00007FFFFD8F0000-0x00007FFFFD953000-memory.dmp

Download

memory/3544-75-0x00007FFFFD90D000-0x00007FFFFD90F000-memory.dmp

Download

memory/4256-99-0x00007FF7D3F10000-0x00007FF7D4136000-memory.dmp

Download

memory/4256-268-0x00007FF7D3F10000-0x00007FF7D4136000-memory.dmp

Download

memory/4256-100-0x00007FF692360000-0x00007FF692371000-memory.dmp

Download

memory/4256-145-0x00007FF7D3F10000-0x00007FF7D4136000-memory.dmp

Download

memory/4256-799-0x00007FF7D3F10000-0x00007FF7D4136000-memory.dmp

Download

memory/4256-796-0x00007FF7D3F10000-0x00007FF7D4136000-memory.dmp

Download

memory/4256-621-0x00007FF7D3F10000-0x00007FF7D4136000-memory.dmp

Download

memory/4256-779-0x00007FF7D3F10000-0x00007FF7D4136000-memory.dmp

Download

memory/4256-743-0x00007FF7D3F10000-0x00007FF7D4136000-memory.dmp

Download

memory/4788-178-0x0000000001000000-0x00000000013A9000-memory.dmp

Download

memory/4788-782-0x0000000001000000-0x00000000013A9000-memory.dmp

Download

memory/4788-84-0x0000000001000000-0x00000000013A9000-memory.dmp

Download

memory/4788-549-0x0000000001000000-0x00000000013A9000-memory.dmp

Download

memory/4788-754-0x0000000001000000-0x00000000013A9000-memory.dmp

Download

memory/4788-846-0x0000000001000000-0x00000000013A9000-memory.dmp

Download

memory/4788-80-0x0000000001000000-0x00000000013A9000-memory.dmp

Download

memory/4788-89-0x00007FF809440000-0x00007FF8096A3000-memory.dmp

Download

memory/4788-120-0x0000000001000000-0x00000000013A9000-memory.dmp

Download

memory/4788-705-0x0000000001000000-0x00000000013A9000-memory.dmp

Download

memory/4788-108-0x0000000001000000-0x00000000013A9000-memory.dmp

Download

memory/4788-801-0x0000000001000000-0x00000000013A9000-memory.dmp

Download

memory/5788-158-0x00000000751C0000-0x0000000075212000-memory.dmp

Download

memory/5788-106-0x00007FF809440000-0x00007FF8096A3000-memory.dmp

Download

memory/5936-29-0x00007FFFFD8F0000-0x00007FFFFD953000-memory.dmp

Download

memory/5964-118-0x00007FF809440000-0x00007FF8096A3000-memory.dmp

Download