hijackloader | 5fbf4248cf1cf10d40143b795230fa72fe7c9dd8df9f83d1d7f7ae4eda0d42f6

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_216eecdd362de6831da0191bd82aff49_elex_wannacry.exe
Size 8.6MB
Sample260809-vm8c3aap6x
SHA256 5fbf4248cf1cf10d40143b795230fa72fe7c9dd8df9f83d1d7f7ae4eda0d42f6
MD5 216eecdd362de6831da0191bd82aff49
SHA1 99ea3b33794a12490a2eeb3532a3f83aebde7a45
SHA512 269e8cef00d742e4ec1e5497a1b84110544295459dc5a87d376b597dd788a4fcae5ee7eb285c38d20334ce973a37af5d9a8891cdd5e7c4b449d2669094654220
SSDEEP 196608:+pJHINKNawxlXWeVy6PPJaeUnYFjgVbweW96ji3HNwQljhN:+pONzClXWBEQCjgVbwTFHiQ3N
TLSH
T1AE963382B381A9B4C9738732CF89D747D2F6F3A636462C1F53551E481FA31A0992B1DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\mon_assist_v1_0
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c44b-45.dat	family_hijackloader
behavioral2/files/0x000d00000001c473-95.dat	family_hijackloader

Executes dropped EXE 3 IoCs

pid	Process
5880	AtomicUtil.exe
1880	AtomicUtil.exe
2784	Converter_Energy.exe

Loads dropped DLL 19 IoCs

pid	Process
5880	AtomicUtil.exe
5880	AtomicUtil.exe
5880	AtomicUtil.exe
5880	AtomicUtil.exe
5880	AtomicUtil.exe
5880	AtomicUtil.exe
5880	AtomicUtil.exe
1880	AtomicUtil.exe
1880	AtomicUtil.exe
1880	AtomicUtil.exe
1880	AtomicUtil.exe
1880	AtomicUtil.exe
1880	AtomicUtil.exe
1880	AtomicUtil.exe
2784	Converter_Energy.exe
5612	UltraF86.exe
2112	AxisFabr.exe
948	libhost.exe
5960	libhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5612	UltraF86.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 1880 set thread context of 5612	1880	AtomicUtil.exe	93
PID 2784 set thread context of 2112	2784	Converter_Energy.exe	94
PID 1880 set thread context of 948	1880	AtomicUtil.exe	95
PID 2784 set thread context of 5960	2784	Converter_Energy.exe	96
PID 2112 set thread context of 1740	2112	AxisFabr.exe	101
PID 2112 set thread context of 2148	2112	AxisFabr.exe	124
PID 2112 set thread context of 1740	2112	AxisFabr.exe	101
PID 2112 set thread context of 460	2112	AxisFabr.exe	131

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	AxisFabr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	AxisFabr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	AxisFabr.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	AxisFabr.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\archive_bridge.job	libhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Converter_Energy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AxisFabr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_216eecdd362de6831da0191bd82aff49_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AtomicUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AtomicUtil.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1756	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307689578965911"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2112	AxisFabr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5880	AtomicUtil.exe
1880	AtomicUtil.exe
1880	AtomicUtil.exe
2784	Converter_Energy.exe
1880	AtomicUtil.exe
1880	AtomicUtil.exe
2784	Converter_Energy.exe
2784	Converter_Energy.exe
2784	Converter_Energy.exe
5612	UltraF86.exe
5612	UltraF86.exe
5612	UltraF86.exe
5612	UltraF86.exe
5612	UltraF86.exe
5612	UltraF86.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
948	libhost.exe
948	libhost.exe
948	libhost.exe
948	libhost.exe
948	libhost.exe
948	libhost.exe
948	libhost.exe
948	libhost.exe
5960	libhost.exe
5960	libhost.exe
5960	libhost.exe
5960	libhost.exe
5960	libhost.exe
5960	libhost.exe
5960	libhost.exe
5960	libhost.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
1740	chrome.exe
1740	chrome.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe
2112	AxisFabr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	AxisFabr.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1880	AtomicUtil.exe
2784	Converter_Energy.exe
1880	AtomicUtil.exe
2784	Converter_Energy.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeDebugPrivilege	2112	AxisFabr.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe
Token: SeCreatePagefilePrivilege	1740	chrome.exe
Token: SeShutdownPrivilege	1740	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 5880	5100	2026-08-09_216eecdd362de6831da0191bd82aff49_elex_wannacry.exe	90
PID 5880 wrote to memory of 1880	5880	AtomicUtil.exe	91
PID 1880 wrote to memory of 2784	1880	AtomicUtil.exe	92
PID 1880 wrote to memory of 5612	1880	AtomicUtil.exe	93
PID 1880 wrote to memory of 5612	1880	AtomicUtil.exe	93
PID 2784 wrote to memory of 2112	2784	Converter_Energy.exe	94
PID 2784 wrote to memory of 2112	2784	Converter_Energy.exe	94
PID 1880 wrote to memory of 948	1880	AtomicUtil.exe	95
PID 2784 wrote to memory of 5960	2784	Converter_Energy.exe	96
PID 1880 wrote to memory of 948	1880	AtomicUtil.exe	95
PID 2784 wrote to memory of 5960	2784	Converter_Energy.exe	96
PID 1740 wrote to memory of 4588	1740	chrome.exe	102
PID 1740 wrote to memory of 1756	1740	chrome.exe	103
PID 1740 wrote to memory of 4784	1740	chrome.exe	104
PID 1740 wrote to memory of 4784	1740	chrome.exe	104
PID 1740 wrote to memory of 1244	1740	chrome.exe	105
PID 1740 wrote to memory of 1244	1740	chrome.exe	105
PID 1740 wrote to memory of 2028	1740	chrome.exe	107
PID 1740 wrote to memory of 2028	1740	chrome.exe	107
PID 1740 wrote to memory of 1752	1740	chrome.exe	108
PID 1740 wrote to memory of 1752	1740	chrome.exe	108
PID 1740 wrote to memory of 4632	1740	chrome.exe	109
PID 1740 wrote to memory of 4632	1740	chrome.exe	109
PID 1740 wrote to memory of 3828	1740	chrome.exe	110
PID 1740 wrote to memory of 3828	1740	chrome.exe	110
PID 2112 wrote to memory of 1740	2112	AxisFabr.exe	101
PID 2112 wrote to memory of 1740	2112	AxisFabr.exe	101
PID 2112 wrote to memory of 1740	2112	AxisFabr.exe	101
PID 2112 wrote to memory of 1740	2112	AxisFabr.exe	101
PID 2112 wrote to memory of 1740	2112	AxisFabr.exe	101
PID 1740 wrote to memory of 1800	1740	chrome.exe	111
PID 1740 wrote to memory of 3692	1740	chrome.exe	113
PID 1740 wrote to memory of 4924	1740	chrome.exe	114
PID 1740 wrote to memory of 3692	1740	chrome.exe	113
PID 1740 wrote to memory of 4924	1740	chrome.exe	114
PID 1740 wrote to memory of 3148	1740	chrome.exe	118
PID 1740 wrote to memory of 1796	1740	chrome.exe	119
PID 1740 wrote to memory of 3148	1740	chrome.exe	118
PID 1740 wrote to memory of 1796	1740	chrome.exe	119
PID 1740 wrote to memory of 112	1740	chrome.exe	120
PID 1740 wrote to memory of 112	1740	chrome.exe	120
PID 1740 wrote to memory of 5904	1740	chrome.exe	121
PID 1740 wrote to memory of 2456	1740	chrome.exe	122
PID 1740 wrote to memory of 5904	1740	chrome.exe	121
PID 1740 wrote to memory of 2456	1740	chrome.exe	122
PID 1740 wrote to memory of 5832	1740	chrome.exe	123
PID 1740 wrote to memory of 5832	1740	chrome.exe	123
PID 2112 wrote to memory of 2148	2112	AxisFabr.exe	124
PID 2112 wrote to memory of 2148	2112	AxisFabr.exe	124
PID 2112 wrote to memory of 2148	2112	AxisFabr.exe	124
PID 2112 wrote to memory of 2148	2112	AxisFabr.exe	124
PID 2112 wrote to memory of 2148	2112	AxisFabr.exe	124
PID 2112 wrote to memory of 2148	2112	AxisFabr.exe	124
PID 2112 wrote to memory of 1740	2112	AxisFabr.exe	101
PID 2112 wrote to memory of 1740	2112	AxisFabr.exe	101
PID 2112 wrote to memory of 1740	2112	AxisFabr.exe	101
PID 2112 wrote to memory of 1740	2112	AxisFabr.exe	101
PID 2112 wrote to memory of 1740	2112	AxisFabr.exe	101
PID 1740 wrote to memory of 944	1740	chrome.exe	128
PID 1740 wrote to memory of 2888	1740	chrome.exe	129
PID 1740 wrote to memory of 5780	1740	chrome.exe	130
PID 2112 wrote to memory of 460	2112	AxisFabr.exe	131
PID 2112 wrote to memory of 460	2112	AxisFabr.exe	131
PID 2112 wrote to memory of 460	2112	AxisFabr.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-08-09_216eecdd362de6831da0191bd82aff49_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_216eecdd362de6831da0191bd82aff49_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\AtomicUtil.exe
  "C:\Users\Admin\AppData\Local\Temp\AtomicUtil.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\ProgramData\mon_assist_v1_0\AtomicUtil.exe
    C:\ProgramData\mon_assist_v1_0\AtomicUtil.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Users\Admin\AppData\Roaming\mon_assist_v1_0\LXQGGWVSNBW\Converter_Energy.exe
      C:\Users\Admin\AppData\Roaming\mon_assist_v1_0\LXQGGWVSNBW\Converter_Energy.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2784
    - - C:\Users\Admin\AxisFabr.exe
        
        C:\Users\Admin\AxisFabr.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2112
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:2148
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:460
    - - C:\Users\Admin\AppData\Roaming\com_net_tracer_rel\libhost.exe
        
        C:\Users\Admin\AppData\Roaming\com_net_tracer_rel\libhost.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5960
  - - C:\Users\Admin\UltraF86.exe
      C:\Users\Admin\UltraF86.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:5612
  - - C:\Users\Admin\AppData\Roaming\mon_assist_v1_0\libhost.exe
      C:\Users\Admin\AppData\Roaming\mon_assist_v1_0\libhost.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:5320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xa0,0x12c,0x130,0x110,0x134,0x7ffc3788c728,0x7ffc3788c734,0x7ffc3788c740
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1904,i,2510267538439842659,7825485749347210457,524288 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,1312060577298610673,14395552387380867113,524288 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:13
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,5465277010882654587,9350967633281851862,262144 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,7101386528354600264,4583362404484091068,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,2293770129563568378,1941197555401018240,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,16859744729246068030,17182258454965480935,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,3111244618455596621,6661748326997320784,524288 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,9260837798083915226,5121859492655768261,524288 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5740,i,7612158816881998713,8667182228583485454,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5788,i,2421393617719875964,18369208133789520823,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5784,i,3887383521043347277,14432001298959581605,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6384,i,4137338962051645230,4939897750855902136,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5828,i,6587966808170269429,1978491521126155349,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6464,i,9876172879854616199,4522136725158471974,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6644,i,14021330818503831789,8102502257601520141,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6372,i,3869531588459935901,9428327890829129051,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6584,i,9606354074328818012,12594619388928921875,524288 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,9755392752124099374,6016432501712497854,524288 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,14384784741769858993,12026181270423891260,524288 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,7243143688898512804,9181387952602436823,524288 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,18031942984610572997,12122937430452388715,524288 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=264 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,6429941151434547137,241862129808265727,524288 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6572,i,14104524399271342918,3150560274042365244,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5848,i,3475316763503165640,5823602371958828658,2097152 --field-trial-handle=2004,i,9850830227519752474,4886183918299254649,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:9
  2⤵
  PID:5260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

03694a07-9722-473a-82d0-2885303d6748.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\03694a07-9722-473a-82d0-2885303d6748.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 541db4c1d2a01726b8b734c5cb82e6da3d2a457b4cb269e85293514e5234c9c4
MD5 d11e8fca5535de0200350d920e0061c9
SHA1 7bf655886a3a4d4e1d8758b9b736e0e43adad8e8
SHA512 c30f12f4f9c7a194f40283e91018d43b60245b8a676cf82e622872f7df4024cc5f8fe2f9adcfbcf9a72deec84db25a2c2dd6086c58bad90d0cedea223783f059
SSDEEP 192:VRW5O+gGv7FAPRp279gHsb+WNn5d0rX2LUYUchVyIsnAUgR:VRKORyUXcqw/0T2okHR
TLSH
T10232B62EB915697BADCBD22AFE217753E7F5202724902E94E7FC892C10E75CD2227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b07b5bedf7aef186ed3a0362ea025e695ed21d79a55e702cecf655aef62da702
MD5 3c7060e1f0099311a913dba527a27745
SHA1 7bd0332c425951432e290ebb3acf0f760e00e971
SHA512 30faca0d170acf732314cd8cb15feaa4a9732acf8eff35d3168f08e8f186dd6a92a81d6d67f2a7f53c5d1257aaf800282b9db9f652a87317a3c2ccd4cda4c762
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN9mjIAl53Ii:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCx
TLSH
T15F32E827A44D9A7B0FD8E44DDC126F8B6DF5419272780D2893FB9C0803A97CE115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 d1a9f249677712ec088216302543ecd0f9ccc74f915b9dcf6a367da90cd4ce0b
MD5 41dae53939ef4933c56b68b08bcf28c7
SHA1 76f02b05961a4b06eac6c51736ce7fe2ecf9d19a
SHA512 3b1fbd37c432202c9c200b076b3420a20f44b9802fa5da69fbd868d31cd544b634a1e0757634819020f90f7c8227456930154937d3251d3ada4a4f9dff39ed74
SSDEEP 3072:ly3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8GZ:nX4NwhgqKR4ILo59R57lOYo84
TLSH
T1A9C312F0E5372BEC6C7A99FF30142A61CFF1A18DA2DCB512CA917569321D898930953E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 91697f68b580942f5e69766691cdd02897ad2ea0fcd193f41a852d9d251586d0
MD5 b5bcfc383180709ccb89f5cfe132e2c2
SHA1 50d133216a2431171288e2bf40e79ffd5bfb5e6b
SHA512 bbc4da86a7f430dfadd2b84cb96a98996f8ed95f57c10fa76022f656103df2eda07590cf95844d7e2a0f0d952cd16a27c270ccd9ce2b4c9e86bb9ee2d1b98a7e
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5c6DbB6gGyvXkQJrbfyYv4a:RC0G4DkG/FZ9kGDUDXlMpQJrbfX
TLSH
T159A10971A47D8EB76972C448F9933A03CEA4A0ABA611EF54DEDD0E0C11FB1DD1342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 39f277a558b9cc16fe99ca314cd74adff369f0efffcd0cc7bd3d920e19eb535f
MD5 d3a1fa5df92a9ab987482f7e7069cc5d
SHA1 6c78df274dbf6e573491427b193a2dacb8b11e47
SHA512 f13bd2d934175faeb6bcbb39397cc11bdad2130bebb5a41700aa8d513652880668807d4e3842b7f37d60112b4909f566e89bec49b4ac19d7d5425d069274b2e1
SSDEEP 3072:0y3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8GZ:yX4NwhgqKR4ILo59R57lOYo84
TLSH
T100C312F0E5371BEC6C7A99FF30002A61CFF1E18DA2DCB511CA917669321D898930953E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8BC15FA.tmp

Path C:\Users\Admin\AppData\Local\Temp\8BC15FA.tmp
Size 9.9MB
SHA256 86b2c6dfbbc462e1ceeb8b3780f109af57e270ffa304489a1eab535e88f9db52
MD5 cdebd1ba40604c73d074a08d4d4558b8
SHA1 dafd9eef3a5e6b6102666337e8cc7936a7f12d57
SHA512 a1bc25687add663db729638ab7daecf86472914327e7d8dde1ff5285f488a6da6f5a99320b5c0ed84ac9154111c7034e4cfc6dde87220c1c30df193a1d2fc964
SSDEEP 196608:sETh7YBrS+dB+hDapzaCrG+JNOudz6m+EmeSUd8x7uRiu72FI+ANlTFoQmzXECo2:sETh7GSO+hDoVsxFx50f+AXTFoQMEvGF
TLSH
T10CA633BF685AA10C8771B20DB6215C83544B1705AD3D1CF4EEC8DC6A296FCE677C0A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8BC15FA.tmp

Path C:\Users\Admin\AppData\Local\Temp\8BC15FA.tmp
Size 9.9MB
SHA256 519bc7ecf3f2032e7d12de7db640d8837cee9bdb9a2146f6236056a799494715
MD5 03486982fff41667c3d045b263b3543b
SHA1 d4853bef862c24be3bd2756f7a29f559d377a809
SHA512 32918ddebf55d954d82570f5c504cf47095c8a436595e6587b07da4c31ecf5215b7880ed277ec1c4bd3cca6b16204593a81bcffb96cc3c090193ca25b1c60fd6
SSDEEP 196608:6ETh7iBrS+dB+hDapzaCrG+JNOudz6m+EmeSUd8x7uRiu72FI+ANlTFoQmzXECo2:6ETh7kSO+hDoVsxFx50f+AXTFoQMEvGF
TLSH
T14EA633BF685AA10C8771B20DB6215C83544B1705AD3D1CF4EEC8DC6A196FCE677C0A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AtomicUtil.exe

Path C:\Users\Admin\AppData\Local\Temp\AtomicUtil.exe
Size 435KB
SHA256 b3bef4c051e89ae793c27353a3f2730d82342080a7f37f8462544c91c46790a9
MD5 579b7cc76e908a201cac21d0811caf1d
SHA1 e14901590b72a01000964339a4de1a358f01efb8
SHA512 ce640eed23a10da85182d3bc4112cc2eb0ec9567ad7c714d7bf8adeb48260f8ace7149144692485d8a79996c5a6e26c7e13f4f3c42665afe84d339e1d5829213
SSDEEP 12288:E1qaYVwguaZ9dqeOl/i21ecMXaZ0oN2T4tbzi+:cqyaqeOlwcgaZ0oN2T4tbJ
TLSH
T1BC944A01BB80D0B1E78603344A66E77A697AAE75175091CFE2683E7A5E302D36D3770F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B272F4F.tmp

Path C:\Users\Admin\AppData\Local\Temp\B272F4F.tmp
Size 4.7MB
SHA256 a7ead5af5f4a4aecf0b515efe8f82e967ff2263b4c0dd48068bf53a2956e50ae
MD5 61e2f800ab271b8772f4df5b3d28b3ef
SHA1 548e1215977e523e382419e54f77ddaa0de33d88
SHA512 9524a4e728a6faeec98254cd81c1999cdfee65231fb2f87f26ccba6a5fe6b144ec13f7a28a542517e00a2f0580e37d35274fd6d4ae28b2b872ff2651ccccf981
SSDEEP 98304:qET/Z7lyBrnMefh6IROTVqV5qRlrmj8z4sc5jD5/JrL0ULiMTARdSjzetMGaZX0h:qETh7YBrZ56uOK8Rtz4b5n5/50UpERIK
TLSH
T1233633828E990E83F738BA7D35C61F785148A0BC7E5D50AE42D1E3ECCECB85925906DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B272F4F.tmp

Path C:\Users\Admin\AppData\Local\Temp\B272F4F.tmp
Size 4.7MB
SHA256 54f9f0cde3a310c8b267ef635243451c869a3a9b89553d6af2d83f4fad786d9e
MD5 79a6fda7a5aff194de4b89ff7fdf07cc
SHA1 8d077e7074c93618435e538027c797f936cb3fa3
SHA512 e297ca3679ed1f475c21aa1aa821dcf34401aa4354a7ed73a5f182db6df244d7d9959be6c91711669cfe5765882001e3a8bea810981336cbcf46740b9b9c7e03
SSDEEP 98304:cET/ZIlyBrnMefh6IROTVqV5qRlrmj8z4sc5jD5/JrL0ULiMTARdSjzetMGaZX0h:cEThIYBrZ56uOK8Rtz4b5n5/50UpERIK
TLSH
T1253633828E990E83F738BA7D35C61F785148A0BC7E5D50AE42D1E3ECCECB85925906DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DF14C9D.tmp

Path C:\Users\Admin\AppData\Local\Temp\DF14C9D.tmp
Size 40B
SHA256 b8c92f7c38b0f906448ebbc46a6817cfdbb7fda6b3d2506468bf6489c4bcdcb4
MD5 4a83ec308d4f191383159d48875473cc
SHA1 7f77ef21b01140cf1e090aa0fe610d22505bcd5f
SHA512 d66b5e7d774716f38355ce580e15e97985ce550e624b2d16af1cba655e10d5c810436f21e25e9c4f89aa1dc0e2cc85e15a6690e6e2ec5a81af6775ca77039980
MD5 SHA1 SHA512

Submit Download

F5C5B71.tmp

Path C:\Users\Admin\AppData\Local\Temp\F5C5B71.tmp
Size 40B
SHA256 de4b267e24ac957ac10cdf090ff12548f8fbbdb1cc7d0a6de917b26b8a87c808
MD5 1d69f7d98ce2ae8372a045eb35b1489d
SHA1 2f4dee27b4e6035470eccbf3a6ab56f12e494d89
SHA512 cc6c08c12c837a9b8bf8a68ceb77178f0996627700fbb6925f95753a4a432f00dbb1bf016ca2d8f3d20b9cffd3dad3c96308b96a6dd232a04de3adc48554966a
MD5 SHA1 SHA512

Submit Download

IOCPTcp.dll

Path C:\Users\Admin\AppData\Local\Temp\IOCPTcp.dll
Size 693KB
SHA256 9aa2dc7ffcde6b3452ecdfddb17415f905b6ec5a1c7dbb8188b5e21e1b519d6a
MD5 828e75f213e345be314588e13fca3fdb
SHA1 a62bb39f1dd0c0132630c0b1c8387e81747b33fe
SHA512 1a219c01d79533023f82b134fd463d26e98856bf7fe422a9125d0edef297f219c33d7e2b2ef6200d983f782e5b7a21b0f059c0e9b6dc78463839c2ecb8a74902
SSDEEP 12288:9qEl/tTVHpB/1/YyBZc1yOFu9NgKPQCilWFXWF9mqjwYOXlVA:fl//zZc1BSVQCiWFXiwYKVA
TLSH
T11FE47D137681C03AC1BE3572412AE77966AD69300F35D6CBBBC89A7D5F745C39A3820E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IOCPUdp.dll

Path C:\Users\Admin\AppData\Local\Temp\IOCPUdp.dll
Size 614KB
SHA256 9fd5c6aafdca9b2ceb717c4ac0d3cb7aa363a9cb6389fa08fbf9af655f0e7842
MD5 b87e7e9d20cb38cfd01fb338fc629c2c
SHA1 25103c8026f2369c344baae9d586760bca3ef9c8
SHA512 dc0dab0bed9443895149f7935b8a1de28d21f8bc6d33127fc305ff5e63aaeb17493d238556cba6f1ab8f453e6b9e359c8e10a1b581595955f1f432c24364f7bf
SSDEEP 12288:t6QN4Fsy+qdNFJ3AMkfkt0bA24ndcVkNao3XYMmFzjH3Lu/Ppr:IQN4yykBkt0bt4LXYMmFzuHpr
TLSH
T1CFD47D137681C072D26E3132811AE379A6ADA9305F7556CBBBD81F7D5F346C29B3420E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAMInstance.dll

Path C:\Users\Admin\AppData\Local\Temp\TAMInstance.dll
Size 94KB
SHA256 f5bcc76672c7fc7399dd645fdab829169b3dbcd60ed8db351bd2f68f7dfffe9d
MD5 71d2f3c36626ec54f4db7bf896e4aa55
SHA1 5bfb36a66a70da6a238032cc784d77fbe6e66508
SHA512 dd6f79b9115ece38d1574f82abbfc7f5f1f600a0e1eb82a37b5bab7e897621a4a17a92128cf03884850e9329b5e43c7c9f449c9b755804dec4c0678a7e66e185
SSDEEP 1536:azWkR97zIzI+YSDEsNrIvu7ncFuu2riMtnPi3et5MaGCVd600t:H097E0juK+W3et5M5F00t
TLSH
T10D938C123A50C177DD8A6A39405AD7225F3E7571AFE8C0C7BF2547A91E213C06B3A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cximagecrtu.dll

Path C:\Users\Admin\AppData\Local\Temp\cximagecrtu.dll
Size 692KB
SHA256 f9e7e7d326fe8498618635f527002d6c88cfa2dfff6291e1be7b8773d3fbf796
MD5 2b11cc839f9e0b1d5e35a46c64aee841
SHA1 4c70a9cc826202e38027d5517d741cb34ce23a19
SHA512 aa28a91b1b92819c3e7ee832218e0be25d44f31abe9de36b5d22fc1c0ce1e43e0fe335b52678bab62d07b732f5d2c65c1dfbfc2c6563cd549054048e13a03f63
SSDEEP 12288:PhZyiXxmKE9JNY7JYGQRfsSK6/sT0TsWOyle:5ZyihmKE9JNmJYFRdK6W0TXOyle
TLSH
T11FE4AF80E6D7E1F2CC4E1934505AA67B5A75332A0339DBE3B7E02F56DD207E1A931389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.dll

Path C:\Users\Admin\AppData\Local\Temp\log.dll
Size 160KB
SHA256 3012003674d44f22a257284fada01961920d0aaf02cc3e842114c59f559996ea
MD5 21c1642287f6ac893c2c625e9ab4ef0f
SHA1 039beb45ce728f7a69663f56ab953dd0ccb1ab8b
SHA512 bbc88ce71b7167849c25e2c24d5ddbf189024b3a36fc5e7e4f3eef7822109e8e11007e164c492443b415dfd4bda0bdd5b31f48e31039004db3bbc291b6d10f4c
SSDEEP 3072:As2XBHEdoxOR3XukDI4zD0gMENi5YIhyw7aQT0q:SXlhxsXu/4zD3MWixkwuFq
TLSH
T1C9F39D12B645C037D68B163C4062C3765B3BB8715FA889C7BBD48B795F207D1EE3A24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 484KB
SHA256 f7ac4ceb149eae5184b957d90ebedd9bc916cd1ba3053548b637b4e32a7f8a07
MD5 f9e704b67eccd77a18965e9cfa128461
SHA1 45c0154c0128d356fa96f23689d945ce4122d975
SHA512 90934ac19549ede7dbb96b763d59ba9ca2a0a4c540ec37b6b23c1827f2efb75a05b8e45162ac74df600f414262ed8962026f500bc302998f67c64595b91f0a42
SSDEEP 12288:Am8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLnM:Ry+sPsxy60euPbn03Ooc8dHkC2eyoLM
TLSH
T150B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odgrh1.7z

Path C:\Users\Admin\AppData\Local\Temp\odgrh1.7z
Size 17KB
SHA256 9060517cb3519c996eb8c47a9296f6bf5e142a74f45a881888f03388a008d096
MD5 6baa9d4fab9a126f914adc34014e38ac
SHA1 b908983f52641628caa9932664daf627fdfd6495
SHA512 b713f95911d283b162c80903d17a32eab23bb046323f99df97bc3e3ba23ef5351d7b433132945d4a51577dd68f102d0857542636b41c9c64cc9e2a2e4062d5fc
SSDEEP 384:T50mSUoeadOEkHaaqKBszgphCT7PIeq0sNGW/ZN:TGR/ea4oaqKBmgphi7PIzNln
TLSH
T1F982E0BE32E284AF11F6EFA01C350A3BB5796999D609F00901F811912B13266EF107F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

particlemgr50.yaml

Path C:\Users\Admin\AppData\Local\Temp\particlemgr50.yaml
Size 22KB
SHA256 8ee7ef5240a92180ec289bbca63a9d58f6cb5855737d8e9c355c515f9ac2a153
MD5 c8233a3e8d654d58b581d4ea160d4d89
SHA1 6d48872ad6e7a5c11fa79c3bf066b7dababfa3ed
SHA512 783c947cdddc860b714a1f77d7d5147f57476585ae6dd4dd739987d60ee8351b60ed5da26a9a42f33420a1ec2901d127634ec8ff06cd3f3c8f7e2790b5dcfe8d
SSDEEP 384:4B3pSKno5yZS72sSkaMKdzXOUer1jkEpNEtAieHBrjg3:48UUoFM4zXKVLfUReHBvW
TLSH
T13BA29EB597AEBBE37C45AD3E66187062D18063B5380E8033B9F825463D154ED9991F83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1740_1090875634\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

socket-bench.bak

Path C:\Users\Admin\AppData\Local\Temp\socket-bench.bak
Size 8.1MB
SHA256 eb6dfbeaf79980f8950629c7c325022fde6f231e817c8813f38518b775fdc2f9
MD5 92df203cf00651110fd20230c7827989
SHA1 c0a0c3136ec4a16c498900a88c7242a0aaf17f2e
SHA512 13b38702868220cd12875cfa8163a12114af67e8712535df383139a70111ea7841f7ce0a32db6624315371c04fe41dc386ad113a9eef819cfc68198a7575d1a0
SSDEEP 196608:3dcwrPS4Q2g+1M5dBIO4Jw8qqKQQ92gtfZEoVlF:tcwrPJQD+65gh7KQRgtz
TLSH
T18D8633C0FAEA40D8C642B2BAC493A4B477E5B1C4BB1DCD5CB6B253EB422BD10765534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 c8dbd811bb85d7e17d457c7938c15ef39dbde395f82e967387e082f2c9860748
MD5 df160b9471e9ce9aa4efcfe625673310
SHA1 54d14ace2f00a93c28984a577ebb47929d29e3cf
SHA512 956af4328eaa55ca44d3c64aa6463f5e4d771d390afae0db9267df8267bad146177b9d7fdae817ec8aaba49d0bcada3f6d55cfa8bdefa9fa3610fc9c9353cd29
SSDEEP 24576:uWiJOihSAdUDRdwE0OBuE4N7qWkGA+g7lyD6ZQtnmcvIZPoy4c1cF4w+:9iJOihSlDxuNN7qLZyD6yt01c1+
TLSH
T1EE453A093585E0AEDC6D3679136BB522346C76924BB8ECC373840BE98E305D17736EDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libhost.exe

Path C:\Users\Admin\AppData\Roaming\com_net_tracer_rel\libhost.exe
Size 432KB
SHA256 3c73732dbf5dd0a75d1c909436983bfc4f20d8fa5bd9cd9a7a31e105dd2b71d9
MD5 300414008e092e1e17ff64e831723d58
SHA1 be381def442f9d0275c80afbc3ce1f1f646dc7de
SHA512 60948e7357978e147073826070cee78021f2d3302145b1b4ab27065e2a57604ac34908cfdd679f388b5a16018cf64b07e0efe78a98c3883a127b52e8e8ef5a5f
SSDEEP 6144:rxQoGR3T8fG9QAgvF6CFpTBL4Qgy9hbWYdB9zlu9BUdN99H4+29Tg:WoKjrjgvF6ChgeFd/lu9BRS
TLSH
T184947B12F1E08031D27235320A75D77689BDB4309A646ACF67D8487FAF71AC19B2672F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Converter_Energy.exe

Path C:\Users\Admin\AppData\Roaming\mon_assist_v1_0\LXQGGWVSNBW\Converter_Energy.exe
Size 456KB
SHA256 113ae73c3b817768eb1b2eb00f617a0192176335ee52c13c091f1dcb0644fe4d
MD5 8cef927472c8841c00a0e59a87b8d74e
SHA1 846b0cdb6850a0bc86308c15bd69ff19a14a5ef7
SHA512 0f38c05b5f040ded12fa7ef0501fc4c1e2e221ac520ebb06d9ab3010c22ebc4670360d4cb97be91f997ea3126b600fdc208a910757463cb7cdbad900c4ebb79b
SSDEEP 12288:n5KKB/vw3gSSE+Z36S0N79cVNp/wur6vfQyoyZjRvt0v:5JSSx5VNBwur6vfQyo+jpt0
TLSH
T1D8A44B02EB02C139F6A713B94DAEED585138AD90170460C7F3E8796E6E35AE33D3255E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XLBugHandler.dll

Path C:\Users\Admin\AppData\Roaming\mon_assist_v1_0\LXQGGWVSNBW\XLBugHandler.dll
Size 526KB
SHA256 2d0dc8f0ac506265b19d7b384a29b85f768a788a67f0ea425735c19b56a4185f
MD5 30edc234758d72c5e2ba6ce5bedfd6a4
SHA1 201793eac1f7c0a48e3895a1e71dc05f853d0664
SHA512 2e1af1b1b4091044b6c333255909a539b91e064ba01573cb263beb301782248da5282ab9233878a2631974979225d3c0b94a9cd3fc35ac18c70d0be6968458a4
SSDEEP 12288:WV+Y9nDlq+kVneDKiJRJh3ZpA6oSE/1SgH:HinJpkuhpC6o7Us
TLSH
T1EDB46C2079C48172D9FA24B946ECB122056DB4F1472496CB1ACC0BFEE9A41D17F37B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broker.sym

Path C:\Users\Admin\AppData\Roaming\mon_assist_v1_0\LXQGGWVSNBW\broker.sym
Size 17KB
SHA256 7951a1f1155129124e56db3f5915b511a856995a4e833f288bbcb9f47f4a8605
MD5 f90c280168bc675c30af053666479d96
SHA1 7a6ec5d7381a7738533060519b8789eb0f53059b
SHA512 c1b44d6d0f59ac657f1074ae6eff0f2f4d3ac66f0e80ec00603e7f58d6cb1edafa84dc5450506ac2dab7764033d875674088032db4c2e15db0940a02eb4f6493
SSDEEP 384:DzeGJXHBwg+UkJVj4ua9X7YOMBRhambH/QmGMc59rVp6y8Zs:vHYR1N5a9X7YO+hpbH4Ziy8y
TLSH
T17A829FB7CFBAC311501E5D1A8221AED0DA9AFBB234CB84B0B48537553801DDAED12DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kernelmod.map

Path C:\Users\Admin\AppData\Roaming\mon_assist_v1_0\LXQGGWVSNBW\kernelmod.map
Size 4.4MB
SHA256 e05da15c145b63168e4d1183f357cdd3c758615d018888f0b6478eddd6d61e14
MD5 eb103bbf81a31b75ddfb7c956c622c41
SHA1 1eaaeba0bf6fa6297e26e067d90664c958a39ec9
SHA512 599ee4adde64554e7ddba0a56db9f36c3cb3416f994f2819bc55834706d38a0ef183d4fa798c1cd981a73a31164faf34ba4b930664b92df7684008c12d47dc1d
SSDEEP 98304:RfNeplpVr/YNNISFiPv/w4FxGSec/S0bB:FopljrgNNRMI4Fx2N0bB
TLSH
T194263314F1AB15B0F6E74A32EC2D1D035E6DDC8155382AF39896CAC1F59C6B3327236A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AxisFabr.exe

Path C:\Users\Admin\AxisFabr.exe
Size 290KB
SHA256 c842c312a0d13835effc9a84e2d7ba0ae857d3b6e3c56f4611a433707d504a54
MD5 5a24234aa21b0f6b2a6f20b278adbfc2
SHA1 4cd60d8c0a442437f9669551bc77506a67fe85b6
SHA512 410ab834ecd8409a9ea25e7230cd9ed0795fce82e5cfdc610f18d1ce0699e06efd0b2152fbaa2da1f8b3982ceb95031fa19ae8953f90a59bb78f28b7958af755
SSDEEP 6144:Xgu6rh8ntL7ejsKRIA+546lPfYwJQ/iAW98:x6rh8ntWjsKRtx0flkiAW98
TLSH
T1F5549D0177A0C473E6521979526AC7B69E3BB8312B2586CFBBD51EB84F307C1E63530A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UltraF86.exe

Path C:\Users\Admin\UltraF86.exe
Size 205KB
SHA256 9198d43f853de25cb704cc208f41e649727356e122c7451c411dd49542a5a582
MD5 44bb65b1d3827043978fc8e11ca7c0b4
SHA1 44ef90807b0047d3aca2278039895b8609d42ca3
SHA512 c41b34ffa2eef8e9d726b6127c299a7b6c1a34d2da09162ad121c619321286e4735cae8bda92c057b4d05e1775a776fe79db354fa187d7d730c350c66137570a
SSDEEP 3072:BXZK8DFucDGt2utXNGYXe4kNEFt11VvK1ooL+L8Fy:BJKM4JVtXNTmeHK1By
TLSH
T13B24395673851899EC77A27FCA834F5AA873BC041B5192CB01B463AE1E33BE4BB35351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-136-0x00007FFC5CE40000-0x00007FFC5D0A3000-memory.dmp

Download

memory/1880-67-0x0000000075610000-0x0000000075662000-memory.dmp

Download

memory/1880-63-0x00007FFC5CE40000-0x00007FFC5D0A3000-memory.dmp

Download

memory/1880-65-0x0000000075610000-0x0000000075662000-memory.dmp

Download

memory/1880-62-0x0000000075610000-0x0000000075662000-memory.dmp

Download

memory/1880-60-0x0000000000BC0000-0x0000000000C83000-memory.dmp

Download

memory/1880-57-0x0000000000B10000-0x0000000000BB0000-memory.dmp

Download

memory/1880-88-0x0000000075610000-0x0000000075662000-memory.dmp

Download

memory/1880-64-0x0000000075630000-0x0000000075631000-memory.dmp

Download

memory/1880-70-0x0000000075610000-0x0000000075662000-memory.dmp

Download

memory/1880-77-0x0000000075610000-0x0000000075662000-memory.dmp

Download

memory/1880-85-0x0000000075630000-0x0000000075631000-memory.dmp

Download

memory/1880-97-0x0000000075610000-0x0000000075662000-memory.dmp

Download

memory/2112-117-0x0000000001340000-0x00000000016DE000-memory.dmp

Download

memory/2112-328-0x0000000001340000-0x00000000016DE000-memory.dmp

Download

memory/2112-637-0x0000000001340000-0x00000000016DE000-memory.dmp

Download

memory/2112-370-0x0000000001340000-0x00000000016DE000-memory.dmp

Download

memory/2112-148-0x0000000001340000-0x00000000016DE000-memory.dmp

Download

memory/2112-350-0x0000000001340000-0x00000000016DE000-memory.dmp

Download

memory/2112-338-0x0000000001340000-0x00000000016DE000-memory.dmp

Download

memory/2112-130-0x0000000001340000-0x00000000016DE000-memory.dmp

Download

memory/2112-184-0x0000000001340000-0x00000000016DE000-memory.dmp

Download

memory/2112-125-0x00007FFC5CE40000-0x00007FFC5D0A3000-memory.dmp

Download

memory/2112-120-0x0000000001340000-0x00000000016DE000-memory.dmp

Download

memory/2784-101-0x0000000075610000-0x0000000075662000-memory.dmp

Download

memory/2784-99-0x00007FFC5CE40000-0x00007FFC5D0A3000-memory.dmp

Download

memory/2784-96-0x0000000075610000-0x0000000075662000-memory.dmp

Download

memory/2784-115-0x0000000075610000-0x0000000075662000-memory.dmp

Download

memory/2784-131-0x00000000004F0000-0x0000000000562000-memory.dmp

Download

memory/5612-146-0x00007FF722BE0000-0x00007FF722DD5000-memory.dmp

Download

memory/5612-118-0x00007FF722BE0000-0x00007FF722DD5000-memory.dmp

Download

memory/5612-145-0x00007FF722BE0000-0x00007FF722DD5000-memory.dmp

Download

memory/5880-47-0x00007FFC5CE40000-0x00007FFC5D0A3000-memory.dmp

Download

memory/5880-46-0x0000000074370000-0x00000000743C2000-memory.dmp

Download

memory/5880-39-0x00000000016E0000-0x00000000017A3000-memory.dmp

Download

memory/5880-42-0x00000000017B0000-0x0000000001850000-memory.dmp

Download

memory/5960-152-0x0000000075610000-0x0000000075662000-memory.dmp

Download

memory/5960-143-0x00007FFC5CE40000-0x00007FFC5D0A3000-memory.dmp

Download