hijackloader | 3769996f8267fb2ee2a1819ed2cdf1746257283e2dcfb28f71dd9f8b4d994b55

Analysis

max time kernel
300s
max time network
293s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
𝗦𝗘𝗧𝗨𝗣.exe
Size 576KB
Sample260717-nrtbdady4z
SHA256 3769996f8267fb2ee2a1819ed2cdf1746257283e2dcfb28f71dd9f8b4d994b55
MD5 c78fcfeeba6e2ae52f28efd2e054ae89
SHA1 894b2932d7e3cde0a42d2249063c5e058a8b9b38
SHA512 883e8e7cb17596544d7e80415cb9c06484c116d1de71add047084356208ff4529a691b23dbaeacdd770f104ae9a325cff3bbe2b532055749ab8f7aff4ca2e596
SSDEEP 6144:qQ/wOnH9FzvPHuifBbUvqBPfGXO0XnUsFTb90nKg2Gedar:qIJ9FbHuOuXXNT55T1dar
TLSH
T10EC419203715853ACA7252B298A86FBF302DEF144BE44DC7A3D87A2DFA715D35A31607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\WSL
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral4/files/0x000700000001cbeb-46.dat	family_hijackloader

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5348	WEmulator.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 252 set thread context of 5348	252	𝗦𝗘𝗧𝗨𝗣.exe	90
PID 252 set thread context of 6000	252	𝗦𝗘𝗧𝗨𝗣.exe	92
PID 4756 set thread context of 6112	4756	Tech_C.exe	93
PID 4756 set thread context of 5036	4756	Tech_C.exe	94
PID 6112 set thread context of 3424	6112	ParallelEn.exe	99
PID 6112 set thread context of 1236	6112	ParallelEn.exe	122
PID 6112 set thread context of 3424	6112	ParallelEn.exe	99
PID 6112 set thread context of 3920	6112	ParallelEn.exe	134

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	ParallelEn.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	ParallelEn.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	ParallelEn.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	ParallelEn.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\databasehost_32_rc.job	Crisp.exe

Executes dropped EXE 1 IoCs

pid	Process
4756	Tech_C.exe

Loads dropped DLL 10 IoCs

pid	Process
4756	Tech_C.exe
4756	Tech_C.exe
4756	Tech_C.exe
4756	Tech_C.exe
4756	Tech_C.exe
4756	Tech_C.exe
5348	WEmulator.exe
6000	Crisp.exe
6112	ParallelEn.exe
5036	Crisp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ParallelEn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝗦𝗘𝗧𝗨𝗣.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tech_C.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3064	chrome.exe
5568	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287632639441362"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6112	ParallelEn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
252	𝗦𝗘𝗧𝗨𝗣.exe
252	𝗦𝗘𝗧𝗨𝗣.exe
252	𝗦𝗘𝗧𝗨𝗣.exe
252	𝗦𝗘𝗧𝗨𝗣.exe
4756	Tech_C.exe
4756	Tech_C.exe
4756	Tech_C.exe
4756	Tech_C.exe
5348	WEmulator.exe
5348	WEmulator.exe
5348	WEmulator.exe
5348	WEmulator.exe
5348	WEmulator.exe
5348	WEmulator.exe
6000	Crisp.exe
6000	Crisp.exe
6000	Crisp.exe
6000	Crisp.exe
6000	Crisp.exe
6000	Crisp.exe
6000	Crisp.exe
6000	Crisp.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
5036	Crisp.exe
5036	Crisp.exe
5036	Crisp.exe
5036	Crisp.exe
5036	Crisp.exe
5036	Crisp.exe
5036	Crisp.exe
5036	Crisp.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
3424	chrome.exe
3424	chrome.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe
6112	ParallelEn.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6112	ParallelEn.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
252	𝗦𝗘𝗧𝗨𝗣.exe
252	𝗦𝗘𝗧𝗨𝗣.exe
4756	Tech_C.exe
4756	Tech_C.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6112	ParallelEn.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeDebugPrivilege	6112	ParallelEn.exe
Token: SeDebugPrivilege	6112	ParallelEn.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe
Token: SeCreatePagefilePrivilege	3424	chrome.exe
Token: SeShutdownPrivilege	3424	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe
3424	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 252 wrote to memory of 4756	252	𝗦𝗘𝗧𝗨𝗣.exe	89
PID 252 wrote to memory of 5348	252	𝗦𝗘𝗧𝗨𝗣.exe	90
PID 252 wrote to memory of 5348	252	𝗦𝗘𝗧𝗨𝗣.exe	90
PID 252 wrote to memory of 6000	252	𝗦𝗘𝗧𝗨𝗣.exe	92
PID 252 wrote to memory of 6000	252	𝗦𝗘𝗧𝗨𝗣.exe	92
PID 4756 wrote to memory of 6112	4756	Tech_C.exe	93
PID 4756 wrote to memory of 6112	4756	Tech_C.exe	93
PID 4756 wrote to memory of 5036	4756	Tech_C.exe	94
PID 4756 wrote to memory of 5036	4756	Tech_C.exe	94
PID 3424 wrote to memory of 4240	3424	chrome.exe	100
PID 3424 wrote to memory of 5568	3424	chrome.exe	101
PID 3424 wrote to memory of 1208	3424	chrome.exe	103
PID 3424 wrote to memory of 1208	3424	chrome.exe	103
PID 3424 wrote to memory of 1596	3424	chrome.exe	102
PID 3424 wrote to memory of 1596	3424	chrome.exe	102
PID 3424 wrote to memory of 3540	3424	chrome.exe	105
PID 3424 wrote to memory of 8	3424	chrome.exe	106
PID 3424 wrote to memory of 3540	3424	chrome.exe	105
PID 3424 wrote to memory of 8	3424	chrome.exe	106
PID 3424 wrote to memory of 5320	3424	chrome.exe	107
PID 3424 wrote to memory of 5320	3424	chrome.exe	107
PID 3424 wrote to memory of 5856	3424	chrome.exe	108
PID 3424 wrote to memory of 5856	3424	chrome.exe	108
PID 6112 wrote to memory of 3424	6112	ParallelEn.exe	99
PID 6112 wrote to memory of 3424	6112	ParallelEn.exe	99
PID 6112 wrote to memory of 3424	6112	ParallelEn.exe	99
PID 6112 wrote to memory of 3424	6112	ParallelEn.exe	99
PID 6112 wrote to memory of 3424	6112	ParallelEn.exe	99
PID 3424 wrote to memory of 1488	3424	chrome.exe	109
PID 3424 wrote to memory of 5804	3424	chrome.exe	111
PID 3424 wrote to memory of 5804	3424	chrome.exe	111
PID 3424 wrote to memory of 5644	3424	chrome.exe	112
PID 3424 wrote to memory of 5644	3424	chrome.exe	112
PID 3424 wrote to memory of 4940	3424	chrome.exe	113
PID 3424 wrote to memory of 4940	3424	chrome.exe	113
PID 3424 wrote to memory of 2604	3424	chrome.exe	117
PID 3424 wrote to memory of 2604	3424	chrome.exe	117
PID 3424 wrote to memory of 4652	3424	chrome.exe	118
PID 3424 wrote to memory of 4652	3424	chrome.exe	118
PID 3424 wrote to memory of 4676	3424	chrome.exe	119
PID 3424 wrote to memory of 3620	3424	chrome.exe	120
PID 3424 wrote to memory of 4676	3424	chrome.exe	119
PID 3424 wrote to memory of 3620	3424	chrome.exe	120
PID 3424 wrote to memory of 2716	3424	chrome.exe	121
PID 3424 wrote to memory of 2716	3424	chrome.exe	121
PID 6112 wrote to memory of 1236	6112	ParallelEn.exe	122
PID 6112 wrote to memory of 1236	6112	ParallelEn.exe	122
PID 6112 wrote to memory of 1236	6112	ParallelEn.exe	122
PID 6112 wrote to memory of 1236	6112	ParallelEn.exe	122
PID 6112 wrote to memory of 1236	6112	ParallelEn.exe	122
PID 6112 wrote to memory of 1236	6112	ParallelEn.exe	122
PID 3424 wrote to memory of 4728	3424	chrome.exe	124
PID 3424 wrote to memory of 4728	3424	chrome.exe	124
PID 3424 wrote to memory of 3324	3424	chrome.exe	125
PID 3424 wrote to memory of 3324	3424	chrome.exe	125
PID 6112 wrote to memory of 3424	6112	ParallelEn.exe	99
PID 6112 wrote to memory of 3424	6112	ParallelEn.exe	99
PID 6112 wrote to memory of 3424	6112	ParallelEn.exe	99
PID 6112 wrote to memory of 3424	6112	ParallelEn.exe	99
PID 6112 wrote to memory of 3424	6112	ParallelEn.exe	99
PID 3424 wrote to memory of 3200	3424	chrome.exe	127
PID 3424 wrote to memory of 3200	3424	chrome.exe	127
PID 3424 wrote to memory of 6128	3424	chrome.exe	128
PID 3424 wrote to memory of 5488	3424	chrome.exe	129

C:\Users\Admin\AppData\Local\Temp\𝗦𝗘𝗧𝗨𝗣.exe
"C:\Users\Admin\AppData\Local\Temp\𝗦𝗘𝗧𝗨𝗣.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:252
- C:\Users\Admin\AppData\Roaming\web_store_shell_v5\RJOBVWSOULJVPPKMFM\Tech_C.exe
  C:\Users\Admin\AppData\Roaming\web_store_shell_v5\RJOBVWSOULJVPPKMFM\Tech_C.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Users\Admin\AppData\Local\ParallelEn.exe
    C:\Users\Admin\AppData\Local\ParallelEn.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3920
- - C:\Users\Admin\AppData\Roaming\WSL\Crisp.exe
    C:\Users\Admin\AppData\Roaming\WSL\Crisp.exe
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5036
- C:\Users\Admin\AppData\Local\Temp\WEmulator.exe
  C:\Users\Admin\AppData\Local\Temp\WEmulator.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5348
- C:\Users\Admin\AppData\Roaming\web_store_shell_v5\Crisp.exe
  C:\Users\Admin\AppData\Roaming\web_store_shell_v5\Crisp.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:5940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xec,0x134,0x7ffc43d0c728,0x7ffc43d0c734,0x7ffc43d0c740
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1892,i,3092541954356378626,12717229993955830512,524288 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,6922278773377987401,10401476364401184186,262144 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,2834064777139438465,13229364705732517814,524288 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,17095134608134252301,410019175940187531,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,1785738945384857036,12199173850791576830,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,4596029129708124896,382242270752997494,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,10825698455103655493,11133114141389726692,524288 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,17467932438637677082,717308925760635912,524288 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5628,i,16068395020389454467,6765991497945464654,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5668,i,14356016578737189719,717226936551030943,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5972,i,8208427597177486092,2758966158295849900,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5696,i,14939526800172237670,11363930685760093238,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6100,i,2443125106059987844,8781349573330284274,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5412,i,3094548500523812638,16231880064015374406,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6496,i,12471862182703929938,8037139649499729671,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5868,i,8172867094827968157,12335885978214010866,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,686997723956458290,6411135427378102322,524288 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,3780223741259366382,13453708971736356716,524288 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,9914202993141298553,5473599474206500757,524288 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4532,i,4431343330996542348,6069464494343102024,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4792,i,1795737647807226932,13981086359364080991,2097152 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:9
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,4676507243758166217,13381867095449225501,524288 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,15814770511979511383,362962581028911936,524288 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,6843553300412786179,12073342931799331286,524288 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,1339287488961830293,16707467775827639667,524288 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6492,i,12988180403024406860,16784266489254641689,262144 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:10
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,5349912761542263186,11643006648557401447,524288 --field-trial-handle=2004,i,14073229513118790314,15187218726253843942,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:5656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c1927bf70e71aa43e32ad6424a2dffaa86ba6396a873b227eda10f8cb4008b9
MD5 ed6bb503896c93e57e88722b3c0db522
SHA1 81d4a1a3cca07eac6bda14bc4a6d1bb72bdb7994
SHA512 88d425067c5f054dccdf307aeded7fba7ac9c73b020fc5512a0d334e0f7a57543249ddf49b20620dfe5d3f97d3ea5525fd18057a0f6b4b53e05cb17653442c0c
TLSH
T1FEE02BE6C821E87715FD179A60102746EB44135727C0596F3B3C960C8FF17765686C1C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 44KB
SHA256 4b2ea4903f5b7075d93ba0ac7cfff861d6c1b49a17538e773f190e6afb0cf006
MD5 1cecb01c24baaf96dacd06d65441a4b9
SHA1 3c3904609dec3a1240f5d712fafcbc57d798fece
SHA512 5f164f1a295c4c9986eb23aa64a9f0a5250db4315033b865379c97e9c01102c74bb0df09fe5d6a85a1d830a8348f09b97c0467fe47705df037c0bfe432b74d97
SSDEEP 48:G0JqQq3qhmr/O43b/Y8uaLNW9WjWbfl4pwUiIxjHx:PCEmrm43b/LuaLNW9WjWbflNIxl
TLSH
T1F213320A9E243C63D08B823F499089E60F39137D728B9DF4556C44B27D81A4595BB0EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log
Size 95B
SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
MD5 021b8d293c14358bb37b18ba45792aa5
SHA1 22e73b3a1d152734191bf7de9472a54be346b706
SHA512 ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f8db8003dd0b65f810dcf0cb03ad60ee66138ac32e06660ad4d787a1ccce53f6
MD5 c4060bf31346949fb12e3f99807ecebd
SHA1 6449745ff5ff85fc6b9b6caea3519f7535b23cca
SHA512 c5e50108e5f96f90b0cf4453b20e6fbb8c876fa44bdf42938c04875fc9842e49e15859717f7b511aa09e8f0db8547e8c6e05e34c6b33f813ed27ad1f3c7ff787
TLSH
T1A3519BF7C7D4C66D881266E49B217A2FCE2D1A18421C3C26C9D8BE8B53E2873D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 3d7c7599176e2cc17f9622de3ea10a4f5966a467d99028776d8c197193ee4d62
MD5 7c299644714ac0a1f9f25af0f5b089d0
SHA1 e28b291152cb3d1e3bc5e8c0bca20cc2ecf9b040
SHA512 dbf531b868a7cba63d8ef044536086ecf927f6d007f1d4767163cb61afcd7ce32c5bdcb8cbc4bb9a4bf4e740de1f768e5c9661aa17b992acbd0b032c09f0fb7f
SSDEEP 192:BRxA+Cz1v7hAPRp2l98Hsb+WNnGV0kb2Vskwl2zVyIsnAUgR:BRxvuFAXauw00G2a0VR
TLSH
T14C32861EBA58797BADCAD21AF9213793E7F5102171D42E44E7F8866C14E79CC222B007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7af3b944284b8c43db69c0464154240058b9dd942488ac7cd6cc64bdf92940b4
MD5 515c75cad6b7b8edb203b38902b7a677
SHA1 2a975b7aa95f7861698899cf4cb9981e64c0adbd
SHA512 40abc2c05fd704f2950c1e7986f82c3a0dca09e5d600c355ae5fea4c89ae53117f1707c7c0a076fa7a16b4dddade55deebe62ebf9669060a333a18ed2e93f36e
SSDEEP 192:BRxA+Pz1v7hPPRp7l98Hsb+WNnGV0Rb2VskwlUzVyIsnAUgE:BRxvLFJXhuw00l2aKVE
TLSH
T11442A62EB954797BACCAD219F9617793E3F5202171D02E44E7FC8A2C15E79CC222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 38eca385d74a0465c5a1ae2e9183f418e8c5df995a072334ee41aa8aca4f4d2f
MD5 72430b88475ce0e45530a004ebc05b44
SHA1 82efa6eafb22c6f1bc52c1d24c9604544c6db035
SHA512 ef2ccadbc2742e1fda6b5a94359a4f74134be0bff284f879c7629b15b7a687ddbacf136d98661b452d7e26bf95a693b2afd68d118426640d908d637c3ae6fce6
SSDEEP 192:BRxA+Cz1v7hPPRp7l98Hsb+WNnGV0Rb2VskwlUzVyIsnAUgE:BRxvuFJXhuw00l2aKVE
TLSH
T12E42A62EB954797BACCAD219F9617793E7F5202171D02E84E7FC8A2C15E79CC222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 48cbcc88875a7e40f96f5d34c4b47658bad92859246ba43e3509fc84d9a873d6
MD5 3f09074df2208ff0b0fb67eb67589e3d
SHA1 f444901a792b995ca0e4dc3f3e77449b6b15f7f4
SHA512 b4b506ccc7962e7b505271459f0c8ee556d2d7f0743cfe7d1462e6df75110546d1d9288138a978d17f1ab763803edd941d6e39ebcca28b5ca8491f950b297943
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKNdrtumtK7rx:Majm97KxkXqKf/pUZNCgVLH2HfgslN1N
TLSH
T12E32D827A48D9E7F0FD8D518CC136F8B6CF5429262780D2896FB9D0803A578E114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a53b82ac98ad31a7891975d20d3e562dd408c06699d3391f980350ef36f76f93
MD5 ab85aca5024b4638edc36aeec67dd962
SHA1 e7a9e7a7ed23d587e4eeb794566a1eee242ac938
SHA512 21dfc552ece5f3b90efb01024c2022b20beffe640b5fe51d4c448e0de069484c55d54c11059a7de8c9182e2d9d6dff9aca8d90cef4a9952e50920500bd996b45
TLSH
T1F7A0021081C85C53CD9053B476611791739148556593534364D144869CDB1E04102608
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b04de.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5b04de.TMP
Size 48B
SHA256 b85d40e271d5823a541a74a5c55cdd79ecc711d65be3473ec33113a15862dbdc
MD5 7a83b6e941cf7f6363a539b1bc2661f4
SHA1 e9a705517d5b289d8ed6d5512c72572ef8c22ea6
SHA512 d5862ffe1e87893adf6a7d340961cc4f7ecffc607023f75bb22167758bacd351a9f8111e441ead6208efde4be3ad6c2be7a4417a2359c4845b2e5686fb3a4b43
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 dfcda82d2dec5c61d6ca5f80d86494dac8018b7753fc934007d6b19acb0dc1c0
MD5 97939f0ec30304e865aad5dca2bf31f5
SHA1 b9791164f94ed0c73e10330dc0171ba32966f0c8
SHA512 ed57670509d13799ae2a72a7930a867229d99ef18222193a86888ca35f5b6f0880f0dbfb6692d35548ec6f7afd12fea695bf0cdaa534aa304f7437cd24c50f06
SSDEEP 3072:oUZsooTkNcDCLzVQO3/YoV4QQsp+BI3SmFiuPvfL9MTpGDihiB:ZZ4YNceHqYhV4QQspKICmFRn+ToZB
TLSH
T14DC3023FBD396AE3D92BF34C3DB3AF1A2E9468971AD0CE8C11A55F0F416E9492506412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 3d95c0acf3fc449e80e4427f32a59f29c8e54fd880df0649d15bcf6959c73f89
MD5 9f09d03a79a0bd63c2126693e59ed129
SHA1 a2e3abc2c672a55b3bc564e3a6f8e54cc8c2ec60
SHA512 4b98b7924897098457e10cf004f520d9e014a6e9fbda5e0b8a524fdb2f641b4358513551bf758ac9ef70edbebb575f6995827b3e29b850aad7d93dd3cd12f7ff
SSDEEP 3072:qUZsooTkNcDCLzVQO3/YoV4QQsp+BI3SmFiuPvfL9MTpGDihiB:vZ4YNceHqYhV4QQspKICmFRn+ToZB
TLSH
T19DC3023EBE796AE3D92FF30C7DB3AF1E3EA4699715D0CE8811E55F0E416E8482516402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 19da12507374db4caad15d9e3a906688206067aad481be5315f18598db45560a
MD5 f3c27b77f9048ce06cb8348a8c53e679
SHA1 100d27e9c503135e20e470c95263f3046db2edf4
SHA512 3a5145447e73b7d05a17d5d81f05ed84616ec4c1e15a705f1fce774098c0705a07d96dfc3e9fcd41706c1e56cc0b7d4bedbd626bb5deec34c0c0f5bcd58f573b
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5kHDOB6eGyvkonWob1v4a:MC0HJm5FHuPgXDUD2uW8nWobZ
TLSH
T1C6A11AB1A4AD48BB59B7D745F8822A83DEA4A2276991EF80D9DD1F0C11F31D81341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 c4dc0000a76cab79e9c12d0ab7bfcdd9b9c0c56946e21b2d564dfa6616abcb1c
MD5 3462a86c21f7f25f7d17ec7a494120c0
SHA1 49192a1e75253b49dc8f30d3327c9c9919030a3f
SHA512 ea55a0f758d0e27cfa3f6c0ffacf48c850fe248e34aa96c4cb9b4f87c4ca967be0765b64568edc89f880fc714bd381e466ef6ab65ac786509234d7e01362a084
SSDEEP 3072:PUZsooTkNcDCLzVQO3/YoV4QQsp+BI3SmFiuPvfL9MTpGDihiB:MZ4YNceHqYhV4QQspKICmFRn+ToZB
TLSH
T1B1C3023EBE796AE3D92FF30C7DB3AF1E3EA4699715D0CE8811E55F0E416E8482516402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 8f59c9e31cdbfb1825bff0adc68fbdb98bcbda93fa2def239a2dab3802a78428
MD5 ffbf5c2d608a8b145d74d37715784401
SHA1 0df1da64135b0d142ac096319cd92617d498b5f2
SHA512 e083680e36ef60cb02aa5846e9fbe938aa8ff84ced947d4b70dc277c2581a226ab36874555b4536cd57a763b51fcd2c7555cbff232dd02836d3fef7c50e22c3d
SSDEEP 3072:UUZsooTkNcDCLzVQO3/YoV4QQsp+BI3SmFiuPvfL9MTpGDihiB:tZ4YNceHqYhV4QQspKICmFRn+ToZB
TLSH
T189C3023FBD396AE3D92BF34C3DB3AF1A2E9468971AD0CE8C11A55F0F416E9492506412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 4e0c8a50b35229a97b23ecd4e611430e4184e076c1eef33654046df67b43616a
MD5 d362567cfb2085bdeb9887040dcba3c1
SHA1 fb8021daf09bdb09ee8c1573ce49ca4b76a926d2
SHA512 25ae1812b7affb1367eaa1290b5d254c86eee202675149ed69d64c30aa909b8a69e35ae370b17b1c122828246cc23ce530311c91966a57f32905e60ea51e0ade
SSDEEP 3072:lUZsooTkNcDCLzVQO3/YoV4QQsp+BI3SmFiuPvfL9MTpGDihiB:eZ4YNceHqYhV4QQspKICmFRn+ToZB
TLSH
T1EAC3023EBE396AE3D92FF30C7DB3AF1E3EA4699715D0CE8811E55F0E416E8482506502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ParallelEn.exe

Path C:\Users\Admin\AppData\Local\ParallelEn.exe
Size 2.6MB
SHA256 54ee56421a67088a76359c6fab0ff64a5d105666b8e226b0fe2b8759bfbdde10
MD5 74585993ad66f985febcc9bfe0cf699d
SHA1 bf6739a1d3ca31d3c84ff37b78ec26473881c66c
SHA512 5f8ee722948e08f69ca7c4080df8da1aa40c30a2a03834883a4f2dea0bb9092499007acf81cfed543cbf3dcd6ad935cb1df93bf80a6a100eb55494700ce365af
SSDEEP 49152:9/Qp+T+WQLh5tA5pD5mgQUQFqNNHUhhyHiz55Q/FT/pgMXm:9/Qp+TEN5o5QUm2Uqiz5qpM
TLSH
T16AD51832DAF3813BF5B200F6A6E9562A7D159B209704D3C3A184AB585BF0DD36B76307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1A19272.tmp

Path C:\Users\Admin\AppData\Local\Temp\1A19272.tmp
Size 4.9MB
SHA256 569497fbd81429f484fa361fb1224ebd86abe908756c8b4a7f4da3b80a919df9
MD5 3ffd2c612d2b51aee3c6b8a2c49ebab9
SHA1 257564a7131411e00d0336b99f8e5eb969c721d8
SHA512 90a1308662d990c69a6b542ea10e133d5b75583de691ec23deb317902ac932a71f5fb8c2ba7a104d75b380208cbc8a1f2cdd714677aab6c0f7b2c64762bff442
SSDEEP 98304:Uvk6WnYdR7Bs9RHCqJxFxEoWTof18OU2mxS9uwYqv7BY9FUqgwrciKlflq:UynELs9RHCqJ3xEVTof18OU25v+mqgwf
TLSH
T1CF3633E622DBB53236052F503C23792C8FEF78D42952A705E778B1B15A78E43F04A676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1A19272.tmp

Path C:\Users\Admin\AppData\Local\Temp\1A19272.tmp
Size 4.9MB
SHA256 accd6cc4ef692ccd97da7dade9da03dc29d01626f68007f2f983b78e2535e22d
MD5 6d20662f68de85e04df62cf4a8fcaddb
SHA1 288e17f65af75e5f5aeaebff84bc8b0abea58f8a
SHA512 8095a5212a002b74c7f554f028c1d622ab821ac247d6d1e51f718ed945cb89be227f53523702fe48e882ac9498e54873e20876fe5c585def1886b4a4d61c24ce
SSDEEP 98304:d5k6WnYdX7Bs9RHCqJxFxEoWTof18OU2mxS9uwYqv7BY9FUqgwrciKlflq:dcnEFs9RHCqJ3xEVTof18OU25v+mqgwf
TLSH
T1CA3633E622DBB53236052F503C23792C8FEF78D42952A705E778B1B15A78E43F04A676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32DA2B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\32DA2B1.tmp
Size 40B
SHA256 8144ae5e46c1e35a78c37c8cd5580be7486bedaee1b41ed5372b83c70ed3898e
MD5 4ecccf33d387765b8393edcc003118c0
SHA1 0ea5838f3d10a8946f16b9799ab06ce46ffc546a
SHA512 0e44f99e64558d18057977559b325d31008a7af28f6a21f8196793f7f76d41d3bb6242eecbddde11f56eb2ff8058df151a1ecb66303f8cb261e69af4fff0d93c
MD5 SHA1 SHA512

Submit Download

548B8B9.tmp

Path C:\Users\Admin\AppData\Local\Temp\548B8B9.tmp
Size 40B
SHA256 6812166d0550bdc30458004ed00812dc15d50cc06e0322f1e71235daf7610eae
MD5 e627ad710a6ddd96180ddf77988bf4ae
SHA1 57813289f94bee77e79a2b7eefddc0100fd020d5
SHA512 e2912ee4d42a650f83cf634f022bedee92aeecfea9b4fb60c17ce185b2492e3245f6d486b9a87cb4df5b41fb84461af80aaf22354ea554a8322850e11cef7a5e
MD5 SHA1 SHA512

Submit Download

E156D47.tmp

Path C:\Users\Admin\AppData\Local\Temp\E156D47.tmp
Size 14.1MB
SHA256 7c0e615378b726ee272bb513d17fdce3d981062aba7bc93770f77d3bd90031ce
MD5 a2d0d38599ddb67b649383dd727418f1
SHA1 71ef1887f8520e3cd8c697e44c1a8762115b1329
SHA512 d3847640856e644a5365d3ca0211eacba81d72d3f641da62d16ccc32f45dc10d6c6c6ea3632d2b2c426ea9513c03ef577751926b04efd905dbc1508e331b0b76
SSDEEP 393216:LsoUX2xqcGVlXv4V9M90IsROc5Mnqv08z4uwDs589H:wjmccGVlXv3nstOnQBkpDzB
TLSH
T1A2E633FCA116DEF6AB88E4979630072924B2D8C5DB49E503C19D1AF837BA3C3C51CD69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E156D47.tmp

Path C:\Users\Admin\AppData\Local\Temp\E156D47.tmp
Size 14.1MB
SHA256 a51052d4a98d9ee80ccc3606434171e6059b949859bf6a9d158b135e4024cdc6
MD5 2529eff49c1345e6af8c30792f2b4cdc
SHA1 c19e8e9689c35cbc2ae3bdde4ed3ecdad9980d1a
SHA512 cba12e80c48751550ba1ae787faafc62b3f92e6f6a1ba460f1a3c60c17403d883db1a6efda4349b03aab1d06d04c20a7d0e2cf17a6e47d1590d9f820a9aec234
SSDEEP 393216:RsoUX2xqcGVlXv4V9M90IsROc5Mnqv08z4uwDs589H:ujmccGVlXv3nstOnQBkpDzB
TLSH
T1C6E633FCA116DEF6AB88E4979630072924B2D8C5DB49E503C19D1AF837BA3C3C51CD69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WEmulator.exe

Path C:\Users\Admin\AppData\Local\Temp\WEmulator.exe
Size 298KB
SHA256 ae7f750cc8e002804edbf463059b60d9ac9d1c97155f532de4380a81a22a0f39
MD5 16b92c67941b88d3a350b50fac597909
SHA1 b4438fffc5c4cfc2960b28d6353d72814108e971
SHA512 c0427996dc071967f846814ed7459790c1d3d53012e035670fe7f6584dbd57b9038c262378e785ba60c430a2104cfdaea00f974d5ed77a5dbd7d6fe8f7dcfd09
SSDEEP 6144:uIh7SRcY/zlwgqtDBcMqhvxfYZXQmoadW:P7SflVq9BcjoNM
TLSH
T1DC548E2AF3A814F8ECA7C27CC9464916E77278050360CADF17A046663F376E05E7EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

frFf.7z

Path C:\Users\Admin\AppData\Local\Temp\frFf.7z
Size 18KB
SHA256 4b39f753135de81c3ea450a78c525a328a97b78318bf405bcfcad49d09cae469
MD5 c8e7cedac8edd124e581b00443ae0a91
SHA1 7f0744466f76bb2f609334de4ba35db59f0818e5
SHA512 1fe78601b8ec1ca838752770853caa61bb0cc45da251bea7ae0d081e9f126a4f8f214b08593646b7a7ef29379607ff0c0f41bb476e0b8acb21c8533f07ff78f0
SSDEEP 384:TNwudCvQY+JAyIBR0HbgariVT4QTRkBDE57sZOCCb20MoX:TNwvvQj/+i7gariJ4QFCCXX
TLSH
T1D282D0F581A86D00E63655809F364E23E596239C6619F2FDB6D2E1B017332A981B7AC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3424_1522046835\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eztwain4.dll

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\RJOBVWSOULJVPPKMFM\Eztwain4.dll
Size 1006KB
SHA256 3ba8def47d369dfdf0c15cbeaf33baa1677342c57de97d1d659a120b6c64c792
MD5 69ccf0eafa559e506b4e6e2773cbdb48
SHA1 79969ff9b3907bd8ce65c28408d5412d37ef40fc
SHA512 06da3d3b9d2b8d08cd83f63e3027a0b4c6cef0bd0af635f4231cb91301060636043cb3130af63841915a03a9acf389b36e7de05a7cf89675126ba436ef22467b
SSDEEP 12288:rDIQ1WJW6u5JqsaT8GNqHvfKn1QlTtY2X8RuCLITH5a:rDIQ18EHoQonIz0
TLSH
T1FD25070099F0C4A2C8700C7FD5AA96F56D76AC59FB1682E396483D7339F13C01636AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\RJOBVWSOULJVPPKMFM\MSVCP140.dll
Size 439KB
SHA256 2c0a3e328419b3b50b0430f38c6b5882e302177f4b003aba6a0e7e035807043d
MD5 c53b950681b9f07a8d56f2ff272cbf5c
SHA1 0ec5c6084b6ce4e9a0ed3cca02ba464450f19d36
SHA512 a48c886ff9dd34344094c00c8ff18ee91a359f06dac4cd42c2e054857cd0a12121ba4baf8e85d158fad5a62dfe4c694e5d80c4682564fe07205ca69139a364f5
SSDEEP 12288:n82bIggWBCs9B+zJT8N/oaTvlbJLsRXhUgiW6QR7t5s03Ooc8dHkC2esjeX8:nbTgWBCs9B+zJT8yaTvlbJLsR003Ooce
TLSH
T1E1A418227B064DF1E58923B572C6431293F9FC654361E3C3A7DEF0692F662C6A633291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tech_C.exe

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\RJOBVWSOULJVPPKMFM\Tech_C.exe
Size 576KB
SHA256 3769996f8267fb2ee2a1819ed2cdf1746257283e2dcfb28f71dd9f8b4d994b55
MD5 c78fcfeeba6e2ae52f28efd2e054ae89
SHA1 894b2932d7e3cde0a42d2249063c5e058a8b9b38
SHA512 883e8e7cb17596544d7e80415cb9c06484c116d1de71add047084356208ff4529a691b23dbaeacdd770f104ae9a325cff3bbe2b532055749ab8f7aff4ca2e596
SSDEEP 6144:qQ/wOnH9FzvPHuifBbUvqBPfGXO0XnUsFTb90nKg2Gedar:qIJ9FbHuOuXXNT55T1dar
TLSH
T10EC419203715853ACA7252B298A86FBF302DEF144BE44DC7A3D87A2DFA715D35A31607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\RJOBVWSOULJVPPKMFM\VCRUNTIME140.dll
Size 88KB
SHA256 bf33857f46e56ea7930c1eea25c5f7175a6aaa3df36bf8301a785e6ca726a0b9
MD5 c33386a6e67be415a24d9c431ffd42ac
SHA1 f2f23860916471bdc332b3bd3e88deef64d4432b
SHA512 bc6d5e908bfaa7a35a8f2e01912412b9460604ea19fd27ee5c6f1a05eb0180a07bf7bc26d430326afc9b81d7f19fb1899e6245196a37710c3e5346d0bc2b4c98
SSDEEP 1536:EbiyVUrqIQsn1xtg6RxkkBGCGHDWbWXaecbGasQLvBrzU6LzNa:eiyLyt/xcRjWaXaecbGzurJBa
TLSH
T100937E5235E482B2DDAF04F0D97AEB076A3DA6900FF129F76B949949DE617C0D73020B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridgefmt.rc

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\RJOBVWSOULJVPPKMFM\bridgefmt.rc
Size 18KB
SHA256 0128fae3ce35c1a5a51cc47a1caab3d848df518f4227b32818547dede86b3809
MD5 c27a3cb0761fe426f12a475bd20f0bd6
SHA1 481328e47607e173dad8182cb18336d73ba54dfe
SHA512 61b9387b053a61740dc62a11b9ad75fad07c88e9e60fa528aabe1704f478af2ca39ad12c1c8cc57095fd80d5ca8a9ed81e6e75afd53ebebcfb093c107f39c94e
SSDEEP 384:fWNP9FpeI/ZY9Vp/HZv+eFnyEUKX1woJ13r/3pfCxLR4XNJ3fvkTrY+:faVFMcZsZ5yEUKN1z5fCxLorvvYp
TLSH
T15D828C79CE166B35BC2915BDCA69F1919640B8B16EDF6CF325ED28077C38248C636C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc140u.dll

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\RJOBVWSOULJVPPKMFM\mfc140u.dll
Size 4.6MB
SHA256 a7c07cc937b9a58794472010d5c90bc5c3c644b339d42b5917573ecd6bf0615a
MD5 958eea0559ac31d5b97c2454233fbfb1
SHA1 acc8f7a765ccd7a389acd39450a14d4d05a33267
SHA512 d32d28b0a9b876abb63efd1788f0c05caf68e865f482e82d578862af524b6195441b297e71b0af2c02b62087b5a79cce3d4df992905419381fb5f5f9ebc864ad
SSDEEP 98304:Lpv7jCfioUprPFRs+6+23X5nFg/5s1iBWHBvFLOAkGkzdnEVomFHKnP3Rr:xHnrPzs+z2HMCoBWHBvFLOyomFHKnPB
TLSH
T12836AE507D8800B5F98E117A8A6CAEB5E56EAC28133E11D77111B71BE431FE31E393A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registrydef.yaml

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\RJOBVWSOULJVPPKMFM\registrydef.yaml
Size 3.6MB
SHA256 3ac184309af366312f26fb69bca016d11840d078446f7354c67ec1c93d105afa
MD5 11dbfcd5a89430c92b0c89fc7b116640
SHA1 89f7700d6f9627374a28676e646c51013cd70a34
SHA512 6f40bc6b5bc24a26596b3034ac6b644d5d03b20a19d65ef4a149759dbb985bfd477e2ad21c51df6a0b85d5c26c8b09cd6fcc122d8ad7ce604a19fc7ebb62ae3a
SSDEEP 49152:Ww/RgtQQFzZineY0JQTL3pIN6PP4FpQjobVJdQlRryTo1dXcnrRLaVm+fhQl7/Ra:DaQQ/m3pIN6IQsClR7DStYh8I
TLSH
T18D06239D4CA895FEE81605B04C62EAAE77BC27F363DD394C2E8E05640989275C1C9F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-43-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/252-1-0x00007FFC68A40000-0x00007FFC68CA3000-memory.dmp

Download

memory/252-2-0x000000007431B000-0x000000007431C000-memory.dmp

Download

memory/252-4-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/252-0-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/252-5-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/252-6-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/252-9-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/252-18-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/252-17-0x000000007431B000-0x000000007431C000-memory.dmp

Download

memory/252-29-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/4756-60-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/4756-51-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/4756-76-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/4756-89-0x0000000000EF0000-0x0000000000F84000-memory.dmp

Download

memory/4756-47-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/4756-48-0x00007FFC68A40000-0x00007FFC68CA3000-memory.dmp

Download

memory/4756-59-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/5036-138-0x00000000742F0000-0x0000000074342000-memory.dmp

Download

memory/5036-94-0x00007FFC68A40000-0x00007FFC68CA3000-memory.dmp

Download

memory/5348-74-0x00007FF6B81B0000-0x00007FF6B83E4000-memory.dmp

Download

memory/5348-135-0x00007FF6B81B0000-0x00007FF6B83E4000-memory.dmp

Download

memory/5348-68-0x00007FF6B81B0000-0x00007FF6B83E4000-memory.dmp

Download

memory/5348-85-0x00007FF6B81B0000-0x00007FF6B83E4000-memory.dmp

Download

memory/6000-72-0x00007FFC68A40000-0x00007FFC68CA3000-memory.dmp

Download

memory/6112-177-0x0000000001410000-0x00000000017BA000-memory.dmp

Download

memory/6112-273-0x0000000001410000-0x00000000017BA000-memory.dmp

Download

memory/6112-84-0x00007FFC68A40000-0x00007FFC68CA3000-memory.dmp

Download

memory/6112-657-0x0000000001410000-0x00000000017BA000-memory.dmp

Download

memory/6112-664-0x0000000001410000-0x00000000017BA000-memory.dmp

Download

memory/6112-96-0x0000000001410000-0x00000000017BA000-memory.dmp

Download

memory/6112-103-0x0000000001410000-0x00000000017BA000-memory.dmp

Download

memory/6112-552-0x0000000001410000-0x00000000017BA000-memory.dmp

Download

memory/6112-703-0x0000000001410000-0x00000000017BA000-memory.dmp

Download

memory/6112-706-0x0000000001410000-0x00000000017BA000-memory.dmp

Download

memory/6112-710-0x0000000001410000-0x00000000017BA000-memory.dmp

Download

memory/6112-716-0x0000000001410000-0x00000000017BA000-memory.dmp

Download

memory/6112-80-0x0000000001410000-0x00000000017BA000-memory.dmp

Download

memory/6112-78-0x0000000001410000-0x00000000017BA000-memory.dmp

Download