hijackloader | 9c8a46b954b8a6dbc29d5cf8aca14da6f5687e412dab1bd07881284edb8f3fe5

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_568c3fbe165163c7f68ace84b2d39269_elex_wannacry.exe
Size 11.4MB
Sample260701-vn28faaz3q
SHA256 9c8a46b954b8a6dbc29d5cf8aca14da6f5687e412dab1bd07881284edb8f3fe5
MD5 568c3fbe165163c7f68ace84b2d39269
SHA1 2e0d15abfaf7f12ff47ea98404a70eb511502e2b
SHA512 80c418ba6804276d94d6df204472b95f68d68785852ce06d7cb5e9eb4a1d9031fec100273c931b04a84e14f9a3b6bfb8ac9fa05137e891a6a0e60fb4c8ee091f
SSDEEP 196608:+p8l7o2ou3wilvdIOpiOkTr1NSWsrvNv3pm8+jk2fSNYpimwgA:+pON3wilvfpidTZNcdMLS/+A
TLSH
T140C633423B191CF0CC64857A9F15D78A6BB2F39636411EC386FC4E796D83AD28A431DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\intterminal
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243f5-26.dat	family_hijackloader
behavioral1/files/0x0007000000024404-70.dat	family_hijackloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-07-01_568c3fbe165163c7f68ace84b2d39269_elex_wannacry.exe

Executes dropped EXE 3 IoCs

pid	Process
5092	Cac_Cluste64.exe
4456	Cac_Cluste64.exe
4128	Cac_Cluste64.exe

Loads dropped DLL 10 IoCs

pid	Process
5092	Cac_Cluste64.exe
5092	Cac_Cluste64.exe
4456	Cac_Cluste64.exe
4456	Cac_Cluste64.exe
4128	Cac_Cluste64.exe
4128	Cac_Cluste64.exe
404	SynthGenerat.exe
4540	RippleEx64.exe
3188	Crisp.exe
4976	Crisp.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
404	SynthGenerat.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 4128 set thread context of 4540	4128	Cac_Cluste64.exe	98
PID 4456 set thread context of 404	4456	Cac_Cluste64.exe	99
PID 4128 set thread context of 3188	4128	Cac_Cluste64.exe	102
PID 4456 set thread context of 4976	4456	Cac_Cluste64.exe	103
PID 4540 set thread context of 4140	4540	RippleEx64.exe	109
PID 4540 set thread context of 4416	4540	RippleEx64.exe	127
PID 4540 set thread context of 4140	4540	RippleEx64.exe	109
PID 4540 set thread context of 1268	4540	RippleEx64.exe	134

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	RippleEx64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	RippleEx64.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppCore\Location\Shifter\Relicensing Statement.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	RippleEx64.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\_Resources\index.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	RippleEx64.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	RippleEx64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	RippleEx64.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\IO_v6_arm_pro.job	Crisp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RippleEx64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_568c3fbe165163c7f68ace84b2d39269_elex_wannacry.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4732	chrome.exe
4276	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SynthGenerat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SynthGenerat.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273993923846616"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4540	RippleEx64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5092	Cac_Cluste64.exe
4456	Cac_Cluste64.exe
4456	Cac_Cluste64.exe
4128	Cac_Cluste64.exe
4128	Cac_Cluste64.exe
4128	Cac_Cluste64.exe
4128	Cac_Cluste64.exe
4456	Cac_Cluste64.exe
4456	Cac_Cluste64.exe
404	SynthGenerat.exe
404	SynthGenerat.exe
404	SynthGenerat.exe
404	SynthGenerat.exe
404	SynthGenerat.exe
404	SynthGenerat.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
3188	Crisp.exe
3188	Crisp.exe
3188	Crisp.exe
3188	Crisp.exe
3188	Crisp.exe
3188	Crisp.exe
3188	Crisp.exe
3188	Crisp.exe
4976	Crisp.exe
4976	Crisp.exe
4976	Crisp.exe
4976	Crisp.exe
4976	Crisp.exe
4976	Crisp.exe
4976	Crisp.exe
4976	Crisp.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4140	chrome.exe
4140	chrome.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe
4540	RippleEx64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4540	RippleEx64.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4128	Cac_Cluste64.exe
4456	Cac_Cluste64.exe
4128	Cac_Cluste64.exe
4456	Cac_Cluste64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	RippleEx64.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeDebugPrivilege	4540	RippleEx64.exe
Token: SeDebugPrivilege	4540	RippleEx64.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe
Token: SeCreatePagefilePrivilege	4140	chrome.exe
Token: SeShutdownPrivilege	4140	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe
4140	chrome.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 5092	1816	2026-07-01_568c3fbe165163c7f68ace84b2d39269_elex_wannacry.exe	87
PID 5092 wrote to memory of 4456	5092	Cac_Cluste64.exe	92
PID 4456 wrote to memory of 4128	4456	Cac_Cluste64.exe	94
PID 4128 wrote to memory of 4540	4128	Cac_Cluste64.exe	98
PID 4456 wrote to memory of 404	4456	Cac_Cluste64.exe	99
PID 4128 wrote to memory of 4540	4128	Cac_Cluste64.exe	98
PID 4456 wrote to memory of 404	4456	Cac_Cluste64.exe	99
PID 4128 wrote to memory of 3188	4128	Cac_Cluste64.exe	102
PID 4456 wrote to memory of 4976	4456	Cac_Cluste64.exe	103
PID 4128 wrote to memory of 3188	4128	Cac_Cluste64.exe	102
PID 4456 wrote to memory of 4976	4456	Cac_Cluste64.exe	103
PID 4140 wrote to memory of 4928	4140	chrome.exe	111
PID 4140 wrote to memory of 1748	4140	chrome.exe	112
PID 4140 wrote to memory of 1748	4140	chrome.exe	112
PID 4140 wrote to memory of 4276	4140	chrome.exe	113
PID 4140 wrote to memory of 3956	4140	chrome.exe	114
PID 4140 wrote to memory of 3956	4140	chrome.exe	114
PID 4140 wrote to memory of 3240	4140	chrome.exe	116
PID 4140 wrote to memory of 3240	4140	chrome.exe	116
PID 4140 wrote to memory of 4372	4140	chrome.exe	117
PID 4140 wrote to memory of 4372	4140	chrome.exe	117
PID 4140 wrote to memory of 4152	4140	chrome.exe	118
PID 4140 wrote to memory of 4152	4140	chrome.exe	118
PID 4140 wrote to memory of 3416	4140	chrome.exe	119
PID 4140 wrote to memory of 3416	4140	chrome.exe	119
PID 4140 wrote to memory of 4988	4140	chrome.exe	121
PID 4140 wrote to memory of 4988	4140	chrome.exe	121
PID 4140 wrote to memory of 3040	4140	chrome.exe	122
PID 4140 wrote to memory of 3040	4140	chrome.exe	122
PID 4140 wrote to memory of 896	4140	chrome.exe	123
PID 4540 wrote to memory of 4140	4540	RippleEx64.exe	109
PID 4540 wrote to memory of 4140	4540	RippleEx64.exe	109
PID 4540 wrote to memory of 4140	4540	RippleEx64.exe	109
PID 4540 wrote to memory of 4140	4540	RippleEx64.exe	109
PID 4540 wrote to memory of 4140	4540	RippleEx64.exe	109
PID 4540 wrote to memory of 4416	4540	RippleEx64.exe	127
PID 4540 wrote to memory of 4416	4540	RippleEx64.exe	127
PID 4540 wrote to memory of 4416	4540	RippleEx64.exe	127
PID 4540 wrote to memory of 4416	4540	RippleEx64.exe	127
PID 4540 wrote to memory of 4416	4540	RippleEx64.exe	127
PID 4540 wrote to memory of 4416	4540	RippleEx64.exe	127
PID 4540 wrote to memory of 4140	4540	RippleEx64.exe	109
PID 4540 wrote to memory of 4140	4540	RippleEx64.exe	109
PID 4540 wrote to memory of 4140	4540	RippleEx64.exe	109
PID 4540 wrote to memory of 4140	4540	RippleEx64.exe	109
PID 4540 wrote to memory of 4140	4540	RippleEx64.exe	109
PID 4140 wrote to memory of 4368	4140	chrome.exe	131
PID 4140 wrote to memory of 1328	4140	chrome.exe	132
PID 4140 wrote to memory of 4716	4140	chrome.exe	133
PID 4540 wrote to memory of 1268	4540	RippleEx64.exe	134
PID 4540 wrote to memory of 1268	4540	RippleEx64.exe	134
PID 4540 wrote to memory of 1268	4540	RippleEx64.exe	134
PID 4540 wrote to memory of 1268	4540	RippleEx64.exe	134
PID 4540 wrote to memory of 1268	4540	RippleEx64.exe	134
PID 4540 wrote to memory of 1268	4540	RippleEx64.exe	134
PID 4140 wrote to memory of 4732	4140	chrome.exe	136

C:\Users\Admin\AppData\Local\Temp\2026-07-01_568c3fbe165163c7f68ace84b2d39269_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_568c3fbe165163c7f68ace84b2d39269_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\Cac_Cluste64.exe
  "C:\Users\Admin\AppData\Local\Temp\Cac_Cluste64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\ProgramData\intterminal\Cac_Cluste64.exe
    C:\ProgramData\intterminal\Cac_Cluste64.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Users\Admin\AppData\Roaming\intterminal\KQAWVWCEIHYT\Cac_Cluste64.exe
      C:\Users\Admin\AppData\Roaming\intterminal\KQAWVWCEIHYT\Cac_Cluste64.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4128
    - - C:\Users\Admin\RippleEx64.exe
        
        C:\Users\Admin\RippleEx64.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4540
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4416
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Roaming\component_ultra\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\component_ultra\Crisp.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3188
  - - C:\ProgramData\SynthGenerat.exe
      C:\ProgramData\SynthGenerat.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:404
  - - C:\Users\Admin\AppData\Roaming\intterminal\Crisp.exe
      C:\Users\Admin\AppData\Roaming\intterminal\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:3664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf4,0x128,0x7ff81913c728,0x7ff81913c734,0x7ff81913c740
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,6864036267831784069,2495675238087335278,262144 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,4114547260831804191,16468388959936271219,524288 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,6225468708138910547,16984585063497477001,524288 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,3157159992371427411,15903470063374072701,2097152 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,3932446969302309644,8185020282324712531,2097152 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4352,i,5464930299977589191,17466381540709057130,2097152 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,17305866696073323520,11767250039750345517,2097152 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,1168587896876845119,14585724028515837549,524288 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5048,i,16779938423341175686,4360360939335486629,524288 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,6122264572062298793,10837545535162410750,524288 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,12301277000752334324,2288451509517682924,524288 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,195600089087955173,2796677231887609836,524288 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,16945635298208246755,898847802871132272,524288 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,1614085969627665628,14661971705845772323,524288 --field-trial-handle=1972,i,1890560802038774768,2878491836832011190,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SynthGenerat.exe

Path C:\ProgramData\SynthGenerat.exe
Size 2.2MB
SHA256 fd0ccd54dc4fb84ec74b741e593d94b859106a2072790a664d973d5ac081e135
MD5 6a1aebbcb0e5f4d278037ccdeae1d182
SHA1 6a53bba0536b25dc27524d804cd41d294803bcb7
SHA512 268299ac836a9230664163370c578a465ad92a3628678092d7366a73e2023e80cae0fa51b4c262318640d376057fd4c77469b34ddf138772b25aca711f91625c
SSDEEP 49152:SqoAB5XnoRBcKYnm2qPHF8/PZbsVuvvjA01Ht5ZR+jXbdbEPLmxkZ:34HF8ZbrvJtR0XbdbCmxkZ
TLSH
T106A58D56E7A400E8EAF7C17CC6465217EBB1B4241770AFDF4AA04AA51F23AE11F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 03759b8adc2bbc8af1357e50a392a2cc533352ca90b90feba765541c4372bd25
MD5 95a2097f954ac002416ce6e7263695b4
SHA1 5111c2bf9a09378891bc82f106578f8971a65992
SHA512 4bca39b221f97b4221ab1344cb121484cad9d51029ca6ecbc758262303c471db36048db4a2f6a293826ef84de6017966ab582a1aabd070a3d45afc9d061699ac
TLSH
T170E02B65C962EC3B18F81718A5698B46E74123576B409C4F373D420C4FB573A858A85C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 16KB
SHA256 629cfe4c16918d3d9ce1d197095789f530d7549fb365453c62c208f0579b94f1
MD5 d422f48c0a4be5755b1c364cd5019264
SHA1 0538f7beb396b91e88932f555bbca679f019a326
SHA512 fe8ae44522974ca5dbbf104225ebb060e1ef327c44afaf808e7674eff6ff300045c75aba16346f0121b64942378534ba084199e968ff8eb0a4a4039c629e82db
SSDEEP 3:OlH/ly8to2lmAlhltyk7tyUtjy1XaJj/glopkzYqK1caaulxyk7tjG4jylwXagUh:KgtAlhiytjc4sdi0S1jawE1peg
TLSH
T14E72129FC7981522C0DDF6BECB41A2AFA3160B15D7554D00D14A4571A01870066FF5C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 7f564fb509c03f10ef73d4cac0a10d6a0faba53912dc1fb38b75aad832dad374
MD5 6580bff0920c22f72bcc00c6fcdc69bd
SHA1 2c9d67280c2426b446bb0fa1080dc069e1e456bc
SHA512 6328cccd879be2b9113cfeca15cc054f5836af25a0ea64f20c1f76eb74a634b06d01104e4d6d1afb979b1f92ed9ec333e6e738fd62be5adb93b30217345fe42f
TLSH
T1D5E086842689C96DB4A584B38376735ECED4340AABC83843675595A42181D1877E56E4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 1KB
SHA256 55fdb954fefdc3d125441c5b6676f676a03a38cdd8f1a90e2ca3ab7acda89836
MD5 5e5c3687f7bda94cfd0a6c42ef9227c7
SHA1 e2cdc53d8b9d3a4ce72639440820d30749f6191a
SHA512 33cdd163985fb6b7371aae886cd9f8c116b89093d27cb63c5b9b4bc6d56065509bb5f10acb6b8ec21c84137162838c3dd09a78bafd4feb38037305a17ad43816
TLSH
T17B212E8C3F410A53FB2A4D7D2CE293267FB4956107E058D357E94C992DEBFB05627098
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 305B
SHA256 59e7d2ef844cd3fcc197d2261c6806288035dd3f9e70b05804c8079ebe3e224b
MD5 a1baf2928932e932094a8a0a9e17c90f
SHA1 fc2e8705aeefc16db5c2e43a57e4082e6f7c3c05
SHA512 9478fa14607543d861f9ac78ed833564c7be944b5cb9c6c900f735d7c91ff11374a5bb213eb0f9793aa55e55d898296c5c575baaf85c7ff584cce9498ad700e7
TLSH
T111E07DC939D8CE7F2081824B023BB34DCACC7402D6EE16427B035480A189E0CE3D02E5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 806fe0cad008dcd6125d5a03ac794108d7829891b57761a282d59d2ff7eb95c3
MD5 ad96a4d2473ecccc5592a0526834c088
SHA1 f0cefc6e21bf0142c5c6a3a8dba4a1dfe68ef522
SHA512 6ea780469d1f95ed22bfc1b00e34d833d0f70cde3e76ac67a77ba0553fdbc52620e450d87ca01077965d19c3aeb5aff2f9e33a9fe295a9f161f258210da13042
TLSH
T15A518EF7D7E4866E851192F5AA116E2FCE7D0A24531C3C66C8D4AF4B43E2872D20179E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 71c6a076f6be6aa1be3070f86b6650c462de23af2ff78bc2ce4b6e2f5a00ac96
MD5 2c278e7ce9f1b887602d079a68f6a86b
SHA1 21411c2d269b63b63126dec8ecf41821c12cff0a
SHA512 6e7ed052cd09779d20bae30eccadca7bf076e7b447ac4ca87d2397886b8280d8868ad49bbf1eebad8c22b7cac64a969cbf3b17e70ac563da69b2fcf1f164ba42
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoO8:OIEumQv8m1ccnvS6IoG
TLSH
T1D5F202FF07197601C0E49675D6810ECFFD2D051D4B97BEC09AAC09F3AB865B3A538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7e45fa0e28f9d2fe2e48836095e166e3b64a9ef3a79cda7647a1de5458e7b894
MD5 07058cf93d4fe808525668035e03bbe9
SHA1 0c70ce52f992c1ab5f82aa26db4562055518ce94
SHA512 eed1d5f21c2c654561369d5c3f8699556e8a845e06b2c24d7d61fc465f4c6cd8fc6286143d966728f32f432908c57b22cd29f4a96087d72ee570bba92fa7f526
SSDEEP 192:3ERVbZY+fSc3rtq/QUtIcv7MF+pAPRp2S9HHsb+WNnVGMdDRt/Dkw87aXBVyIsnH:URL/H3f+goUX91wfdDKaX8
TLSH
T17942D92EED11697B6CCAC61AFD627B13D7F5103222C41E54EAFD8A1C05E76CC621B05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2d0ad6c45d67f78cba06766b2fc81cad6192bfaca1099e071b11fd978c4d8b75
MD5 6c543b819a10afeefd4d25d342d30199
SHA1 a15ad1778dd493b9074660fb3119e23b4cb0bff8
SHA512 955ecc62a105e64481b729a48b57f3eafbbe024bdf64685eab962c21283ac352b2f774bb449cd7313d8b0fe7dcc200ab88f5a6a5d66ed04d3057dddaf7816149
TLSH
T1D3B0120080425501C04203B01166648871549F10FB0A270143E0AD26E935161C014151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59400d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59400d.TMP
Size 96B
SHA256 54f61270bd47b76a44e4a0a4f9c34d58be97c23721b2e0b99bc3d1ffcde4a8f3
MD5 31ad8919f6cf3f02d785e2d60ef543a3
SHA1 5f5214cf6b54f4cd6d44ffe7624723c80a4e7998
SHA512 dcbd64c67a0ccd9b6d82065bbdb52d6a2d66edba9b4e3230dee98d8991d09c3bc611d8200cc78b50ce216baccebe01a3a3980a11d51330fb73ae2fd04c026609
TLSH
T1A0B02228C3023203C00203B0228082C830A0CF20C2033203C2E02A22EC2023023382A0
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 5e5cebdd24b0ffbb0d9259d382669c7f2e008446e06e519d50f19bb440076808
MD5 467544ece0baea2d955aa8ea4ca5f8dd
SHA1 2068fee2d9494c166e3729503c28b85525efca98
SHA512 17bc89e350cd37e432f0425a6f4704994f2babff1e994012957f52b49ec78532628ecfe6938c06b4f26b013a5946122659c027345d552cbad8be0b6729291d4d
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OkG8VumB3na:1nbZeMrv/hGtkGyna
TLSH
T187D3884B3A747002DDE59A722CE051BB5E3C716D4F51A5D438B620688EF2963A23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 42922d75ead9508a8d4da92b495d5a299e1f7ab2a8245d20e2bf56fe7065f666
MD5 e2fe6de0ad1dd6cf5551b9f2d9f3baa6
SHA1 df714f2b3b728ff6dd27df26f7b72faf4e269a43
SHA512 8ca2f29548ba7348bd3fd02d0a147f16c74dfb9685d904ed08d731cfb2d3dcc75c11530e8340ecac256ec9a68a6ffda91b24384779b91be67ae18043e415d095
SSDEEP 6144:+Qqmg1kQfATCFbzQACjNm7Rkm1tYpBeh2BAor:+LneAB9oBGcAor
TLSH
T1FF34233F4DB05D7A1A651B5A608A1E2E2EF19F7BCE215D98C0D91B0477DED890B46830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 86411dde4badfa2edf5d22bc95709dee92bcebc6be63657e4f6691ef3905f7a4
MD5 2c117938e3d6b848ef2653f8e3206fbe
SHA1 18aa55758632948d2ccda00ed1e78f2969a0064d
SHA512 60fc3eec6b55a13e44021fb1347206bf36d720acdde6c6cb17bfff95c86d0abc3c22dc7078e800a95d43539d820a2a15e207777a8376082a73954f660c5275b8
SSDEEP 3072:/+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Zm7Rkm1tYpBeh2BAoM
TLSH
T181C312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 6e87e3052d4ab65458c69281a5540df6e33b6e79065d96ee31c9a7ade5b70f9a
MD5 31c7c620c08705fa1c11c74038195eb1
SHA1 35a3be8258ab4eda39622a91990d9b12f9c89e81
SHA512 2062e246ce98f535fc9c6789b27c0cc250e690f212531542dc383decf732af109b1c1d1f6d8a766162286b46c5d7e87401d5606fb1862cd3bbc077b6bc8c9a07
SSDEEP 6144:Fmmg1kQfATCFbzQACjNm7Rkm1tYpBeh2BAor:FWneAB9oBGcAor
TLSH
T19C34231B4EB05D7B1A251B66708A0F6E2BF25F7BCD215ED4C1DA0B4437EAEC9174A830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 46593c7d12a16b763d0b5cd16d784f7ab3f075e34c8c5a6e0e6a4847a9a9cf79
MD5 442d1cde612f2c1414c844a84b5c04cd
SHA1 f1e68a41f4f2d6e4208120bedd830a2c0b93dfba
SHA512 6c8db8dc9367d329c1764de7b340c579ff5d3ff9b20c74361a459230318e8b1f12367f40b471afd1bed6289c49da269522c5ed6958058a0eafec47646fd63ebd
SSDEEP 6144:+mmg1kQfATCFbzQACjNm7Rkm1tYpBeh2BAor:+WneAB9oBGcAor
TLSH
T13234231B4EB05D7B1A251B66708A0F6E2BF25F7BCD215EE4C1DA0B4437EAEC91749830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f54b7c77

Path C:\Users\Admin\AppData\Local\Temp\30d8acc2\f54b7c77
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3309-edc3-123d-0ef7.tmp

Path C:\Users\Admin\AppData\Local\Temp\3309-edc3-123d-0ef7.tmp
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4140-e1ce-06cc-9d70.tmp

Path C:\Users\Admin\AppData\Local\Temp\4140-e1ce-06cc-9d70.tmp
Size 18KB
SHA256 4704482514af6d30088c87850b5673fe138a676b2acff538b372f3f3ac796698
MD5 13ca012f449f9590c74d231d2e941f14
SHA1 592acfcccd076c12e5831f5d7d98bd9487fcc05f
SHA512 5b315a55670886fbf907e0da7ccc1569aadeb918c389a8f421c0c46d2d9a0f9faf59b88b218ae213dd6197ae0d9a015531c799fcf37e454c474e6d33eb426813
SSDEEP 384:3rYxIfJ/EJ+3ubndjRlAIxd8O3+FBKX26LNv0w+ZrBDFykeDNTcjZzY0v4:3UqB/EJuOndtB3iBKX26LNv0BjB/eD08
TLSH
T17382E05348DDFC2FFC229D6840E4EB0949D09E83620B4AD9B9C2DAC056AC1BDD17BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4735D0F.tmp

Path C:\Users\Admin\AppData\Local\Temp\4735D0F.tmp
Size 14.2MB
SHA256 8f2ca32951e4ee062f3345bd7fc115632d02421be27c2772a8121a1e861688dc
MD5 13dbd1a1a951b204517410317b3089ae
SHA1 372da7b58c0ab5e8ec22cdf13395e3770509f7fa
SHA512 11c2e3a648abb09b54f32f201914d61b4f8d52890140acb9b6c405540a49525178ad1cbb24743e31af3651e593e45cba3f6acdd52d2c0496f1d7db06163e4b7f
SSDEEP 393216:CKbGSBnGFpxl6m4HxKPOrZNyIBNM/hrH5fX9ff:CKbGSBGSm4HxPrZsI3MhDpNn
TLSH
T1EAE633898C873190988A34ACBCDD67A847448614369B366EFFC53770BB594B1C27FE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4735D0F.tmp

Path C:\Users\Admin\AppData\Local\Temp\4735D0F.tmp
Size 14.2MB
SHA256 1887a222c9170865af97d13e9cac57afb0ecc234292d8c8ec5a19958806d4a17
MD5 c69cc1e80a82bf96314cc1111be2f886
SHA1 893642138deb3803784a4d42dae74637f94f53e5
SHA512 4991304b846ac4f35599328db3aa317dc48d83a94c66185821b0776b980fc93fad8afbed0e7f33a1f3f385b9ca0e71d072e4240b38eb1ccfa3948fe3837d3025
SSDEEP 393216:sKbGSBnGFpxl6m4HxKPOrZNyIBNM/hrH5fX9ff:sKbGSBGSm4HxPrZsI3MhDpNn
TLSH
T100E633898C873190988A34ACBCDD67A847448614369B366EFFC53770BB594B1C27FE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5C36ACB.tmp

Path C:\Users\Admin\AppData\Local\Temp\5C36ACB.tmp
Size 2.8MB
SHA256 13a26d5e4b716c17ca7a0cbb3025661126bf63188fa43bb4a62993742c74b164
MD5 406a7f239020bea5b298e51ce63e4b36
SHA1 3f86a79368ae55d587b12ef807bbf21f1b93e08c
SHA512 5a7afaa60949d9c5b16f10ab0257a6655787c568bec07210a79e549a9ab07e241c9b52de430dbe8247e9b9df2f13d2949e5470c3ac9bd431c1b4848d99ae895a
SSDEEP 49152:Cn0GNi+NTfxAoK7e8A1W3j81N7RzHIZ+XV4ThVE49T6SBnw/vOTpO8sdsvKNB8y:vz8rxAoKi89j8H7JH6+F41Vb9eMn6CI3
TLSH
T14DD53325564946543FAAD0A0FF7DBCEA01E682B90F21AF42DF8764B46E4D2C37417A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5C36ACB.tmp

Path C:\Users\Admin\AppData\Local\Temp\5C36ACB.tmp
Size 2.8MB
SHA256 37239ebf197f7d466c4b14bd041b0c09c0188222065a989b806ab11a74e28e7c
MD5 be4cf1bab7282e2dcb434726297a8753
SHA1 fdf610a33dd5c1d6abcdc27e17c59341018526b7
SHA512 16ba2aa7ea5e7c9c7c64962cae399c53d1a9ef34ea9615a2c4be31b72a7d11421c94208c6515ce855d5199cbe44efc3b9472fefb0c83e12854b8220fba311df7
SSDEEP 49152:mn0GNi+NWfxAoK7e8A1W3j81N7RzHIZ+XV4ThVE49T6SBnw/vOTpO8sdsvKNB8y:Dz8qxAoKi89j8H7JH6+F41Vb9eMn6CI3
TLSH
T17ED53325564946543FAAD0A0FF7DBCEA01E682B90F21AF42DF8764B46E4D2C37417A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e61-fcaf-ef40-e5a2.tmp

Path C:\Users\Admin\AppData\Local\Temp\6e61-fcaf-ef40-e5a2.tmp
Size 288KB
SHA256 ae828a714462113f40ac9acf853d09075c0e45991bf6116fc4294e7eb5caf714
MD5 98d907006554bad6a0dbf9f8a961936a
SHA1 108eee869d6fe4cd0024bc77cb5cd383e5d19a91
SHA512 61766ada791b316dcaa0eaa92b5f10cf9844dd6659a11e540949160af2c5f56c20807380e2692df94832755f3818e42ac9ab208a97f4ce311fedd259fa4adeaa
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vruyX9+C8z+D8:f1zkVmvQhyn+Zoz67k5X9T8KD8
TLSH
T11B54DF47ED84F10AD70F6830C6554DF27901AB0443925E2BDABC0E7E1E72A0DB9AC5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9388F0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\9388F0E.tmp
Size 40B
SHA256 ee30231ef156bc7912fdd8dccc73e84aad0e51c91cf4c4520f5e38677d088264
MD5 ce7dee3bd5730e972b125a155031002f
SHA1 71dd615a4f03331add02fe6e0eab18a7b7db30d9
SHA512 c841016ebe58dca9b851afaf94f31f6967dbfa0ffa9ce069cd12e5241008feac7d9fe5c05cc21feffa2f304053851e92aa588cdff413c019af9aa28c15c65556
MD5 SHA1 SHA512

Submit Download

97F91FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\97F91FC.tmp
Size 40B
SHA256 2d2c045a9a081229e86ce65f1caba1d838bcc2ad98ab916f3e30c56110c4fc9c
MD5 d2d10dd9eab39da9ee75e2a64e38bdb5
SHA1 af816d648e5d299fe838b98f110d3b23b6eeea46
SHA512 5ec7f6b831ab8df7c09e712e5f40e913615bd7f2f5a685ed7869768b44509fc9b0b33744ec31b1acf61ba3f2b4526a96b1b231428b36051379ef4ace086c6854
MD5 SHA1 SHA512

Submit Download

Cac_Cluste64.exe

Path C:\Users\Admin\AppData\Local\Temp\Cac_Cluste64.exe
Size 102KB
SHA256 371a329380f120761b46ee10739e61a689b541212e53c7cd85b22a468ac33a88
MD5 011bebb919b250a6841c9162489d1523
SHA1 5985fbf0eec12d25a72917d8642648a83c6c8588
SHA512 03ac0171631f50b675f323f65251721d571073dce3d3b3979298a72f7d9f78ce7e03bac05594ccf312ef2cbb649c25bdec61e80b7b9aeb7c45ee69ade13f40f5
SSDEEP 1536:RZwn7CIxHHWMpdPa5wiE21M8kJIGFvb1CwP/i4s+yt5/9jrfIbHanzb:RZw7BwMpdCq/IM8uIGf1/i4s0Teb
TLSH
T1BDA3E741E62DBDCDE548D4314A75D4F26D24ED327680A51EB7F3BF062831293FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\kbJ1yuN\6YH2GE0\Default\FIVCs\Login Data
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\kbJ1yuN\6YH2GE0\Default\FIVCs\Web Data
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\kbJ1yuN\6YH2GE0\Default\kQUuaHq8\Cookies
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kQUuaHq8

Path C:\Users\Admin\AppData\Local\Temp\kbJ1yuN\pRMVHIg1\nxqdpovk.default-release\kQUuaHq8
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\kbJ1yuN\qVrH30\Default\kQUuaHq8\Cookies
Size 20KB
SHA256 39b7352d063ed44876347511832bb259516c01fcb576489d1f3357adc0f8ed15
MD5 92560b483d2f989e308c805409386283
SHA1 5ebbe6e5089761e5e205667dc41104b6bfad2a8c
SHA512 b63f15ac615009da8f3470fc4acc31e4917275360c03a8b972509e21d965c80e2bb176486a0cddb9cacdfdef792965675e23f5d117190319bde57c5495d1e5f8
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBNd553KhYkfvUmVjuij:TeW9aw/aHLopFMavU1iBNH5HKdP
TLSH
T15292EF4F1F703621C5F48736F9C108AB2E3C252C93136AD9AD5490F39DD646BF5065E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\python314.dll
Size 6.4MB
SHA256 d581ca404eda0f9a46674799d87870d25fc9e0092c37a799ed5ce9d7f9d80542
MD5 9f37c5f9b9a07da240dd798dbbc18865
SHA1 6772891ede2f8439b04b3d27663830276c375707
SHA512 64ec6902deeaec4d4f7909fd7e58065a9a25ee38a9e19769a6e8132d96bed31e14578ced8bea86a807eef7047a6587fc7daa57de1fe6a4e1c0c21630320cd886
SSDEEP 98304:kxcTCXWA5Ddpyd7cZ0dYf8fP+Pzt1bMM9ETRv7HDMiECC2:kqTCPDS7cZ0dyIWPzlNiq2
TLSH
T133669D26737811A4D9BB8035C9034647DBB1BC04AB30D34B49A4B6DA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandboxproc.json

Path C:\Users\Admin\AppData\Local\Temp\sandboxproc.json
Size 33KB
SHA256 cb51b83b66573be78260e7a967c295fd9fca74349b9aaec7bea9d492ceb6692a
MD5 90cde8c16ac9c2e7abd9f7c8cb9f8c8c
SHA1 1cce088a77747530fed490cf39148efdf78b37bc
SHA512 c2e5c897870fa1bc9f4851eff9a47e122a9433f23cf2549e8aaa031c21337846ba633de3cf1548fe6ba8595e706e047cab066f250e5fcce9b15ed61e93501808
SSDEEP 768:nVHg/WXH0gsuZ1GIqx2v7UxHn+0iiUjEIgwcmr7:VH3XH0gsuWIqx2kpc8M7
TLSH
T1E0E26C7FAC2E4A55940E5D3EDB28C021D348F0F43B0EB662AAD9245F7575AC8D630DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thread_host.meta

Path C:\Users\Admin\AppData\Local\Temp\thread_host.meta
Size 9.8MB
SHA256 514537bd46e7651f6334944db455222fb89ac0aea8de38b731abffb6cf8c2846
MD5 1c9f0c5be3e5545359e71a7638e58a63
SHA1 6a0d011822d0ce3e75b84d2c6ee3160919d3f8db
SHA512 8dd4e9e5f46e65698f1c24854799dec0360f86495a7f3a5e2b16cc1e949cb619569dec2e3dd1db975106fea6973db71d4760766551ccdecc290004d5f5c67b35
SSDEEP 196608:O5u6SHhqFFIZCzHStSz8BkEBw33ztg8bMEug1fZf5:H5HcFqZCzSt8CK3ztg8bp1j
TLSH
T107A62378A08C0661F78B34F1D0B84EE7E957736AA3640B3E429684C17ECF65DD046B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 d93ce42cd625510b2355de086bcd19e2c11307ccade7bad62b09c7f340a866ba
MD5 24ebedc58aa4ff23043bf79b05d267d4
SHA1 c2e7bd18e4091f2a7f7c933a5734b05dd971f24c
SHA512 7f0563e814cc4aaf292683403888340bb5d95e6a7bdd35d81eebbd10bfb8e4e5130d0a626b8fb07ff3cafaae4a2698cf7103aabcae74e5d13449db482ec49bc9
SSDEEP 24576:2RmADWOBBIHv0XESwR5H7iFZBmai0gFcszUmxvSZX0ypm7:WtI045H+ZB7fgDz7
TLSH
T1C835AE28B76C02AAC57BE17DC923550EF972380447709ACB03A74BB93E277E956B7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\component_ultra\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thread_host.meta

Path C:\Users\Admin\AppData\Roaming\intterminal\KQAWVWCEIHYT\thread_host.meta
Size 2.3MB
SHA256 0f45a093f2c6f059a553c65dd3da353b00ad5955331b2fcf63a43a368f62b3c2
MD5 0a2c13f44d0631235c7c5bb23aa5e16e
SHA1 a8634bb75da37c9e220a561b0bd76535454180e0
SHA512 65152f040c7ca6d9d6e0d89b380e9de5fec2cf454a7fcdedaaa9e7f28764d2f524ff05098fb63c2dafdd5738d28512d8a16bea4931cf18a4966374619aaef3bd
SSDEEP 49152:aw/Ml6Q8Rg+4lLwCdKjIwLEKTH7XTraEQlzoFjg5qXP8KZ/y7O:aw/MgW+4lLc8w4e7X/a/zoRg5qXPz
TLSH
T1BAB52311E2ECADB9C4C3B47680C43F0E66CF25B5AF3946E0B465BE8D18956031BB6D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RippleEx64.exe

Path C:\Users\Admin\RippleEx64.exe
Size 546KB
SHA256 1d1d2245651632f1fce464eda9d5c5ea6ca43b4a04424601ce8c890951111028
MD5 c39a4cca58bedd9b3ceda4d0d3e1e94a
SHA1 0ea31e219e83aa4ba169ef2a132af8fb52f54bf4
SHA512 673794aee7f54a6a1191069a1647ff085c8da6c9bdcb8e358e9969c51c9782993c5e73b938bb4388af012a6cb279e1faf324af55c49748a85b8159c170f4252f
SSDEEP 3072:BBPlwpY3YKF0MrrJq+DNBg0DJtOJs9cAg0Fub+A5aiMqKIDqLqprqpB:rc2XFRJ3DNuzAOS9F4DqLqprqpB
TLSH
T199C43821B4C1E47AC862073008E9E6B57579FC215E72863F33F47F2F3B762816565AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-268-0x00007FF780E10000-0x00007FF781041000-memory.dmp

Download

memory/404-224-0x00007FF780E10000-0x00007FF781041000-memory.dmp

Download

memory/404-177-0x00007FF780E10000-0x00007FF781041000-memory.dmp

Download

memory/404-101-0x00007FF780E10000-0x00007FF781041000-memory.dmp

Download

memory/404-122-0x00007FF780E10000-0x00007FF781041000-memory.dmp

Download

memory/404-269-0x00007FF780E10000-0x00007FF781041000-memory.dmp

Download

memory/3188-168-0x00000000752B0000-0x00000000752FF000-memory.dmp

Download

memory/3188-106-0x00007FF837070000-0x00007FF837265000-memory.dmp

Download

memory/4128-71-0x00007FF81AA50000-0x00007FF81AAB0000-memory.dmp

Download

memory/4128-73-0x00007FF81AA50000-0x00007FF81AAB0000-memory.dmp

Download

memory/4128-97-0x00007FF6EAA40000-0x00007FF6EAA5A000-memory.dmp

Download

memory/4128-82-0x00007FF81AA50000-0x00007FF81AAB0000-memory.dmp

Download

memory/4456-75-0x00007FF81AA50000-0x00007FF81AAB0000-memory.dmp

Download

memory/4456-44-0x00007FF81AA50000-0x00007FF81AAB0000-memory.dmp

Download

memory/4456-77-0x00007FF81AA6D000-0x00007FF81AA6F000-memory.dmp

Download

memory/4456-50-0x00007FF81AA50000-0x00007FF81AAB0000-memory.dmp

Download

memory/4456-47-0x00007FF81AA6D000-0x00007FF81AA6F000-memory.dmp

Download

memory/4456-62-0x00007FF81AA50000-0x00007FF81AAB0000-memory.dmp

Download

memory/4456-46-0x00007FF81AA50000-0x00007FF81AAB0000-memory.dmp

Download

memory/4456-51-0x00007FF81AA50000-0x00007FF81AAB0000-memory.dmp

Download

memory/4540-223-0x0000000000E00000-0x00000000011A9000-memory.dmp

Download

memory/4540-341-0x0000000000E00000-0x00000000011A9000-memory.dmp

Download

memory/4540-92-0x0000000000E00000-0x00000000011A9000-memory.dmp

Download

memory/4540-96-0x00007FF837070000-0x00007FF837265000-memory.dmp

Download

memory/4540-84-0x0000000000E00000-0x00000000011A9000-memory.dmp

Download

memory/4540-374-0x0000000000E00000-0x00000000011A9000-memory.dmp

Download

memory/4540-267-0x0000000000E00000-0x00000000011A9000-memory.dmp

Download

memory/4540-176-0x0000000000E00000-0x00000000011A9000-memory.dmp

Download

memory/4540-113-0x0000000000E00000-0x00000000011A9000-memory.dmp

Download

memory/4540-120-0x0000000000E00000-0x00000000011A9000-memory.dmp

Download

memory/4540-306-0x0000000000E00000-0x00000000011A9000-memory.dmp

Download

memory/4540-199-0x0000000000E00000-0x00000000011A9000-memory.dmp

Download

memory/4976-111-0x00007FF837070000-0x00007FF837265000-memory.dmp

Download

memory/5092-27-0x00007FF827EE0000-0x00007FF827F40000-memory.dmp

Download