Analysis
- max time kernel
299s - max time network
281s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/08/2026, 00:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
29 signatures
300 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
29 signatures
300 seconds
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
27 signatures
300 seconds
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
300 seconds
General
- Target Setup.exe
- Size 7.6MB
- Sample260819-amfmtstdle
- SHA256 9f4e92d43db6f77fc3b5e7a764afb703ed327e595ff693bde6e03d7eb0e1cf19
- MD5 677d3e43a0ee2b00841b8e6eacb4f2b3
- SHA1 14881a228c7220a44369127c85f64071627b5f22
- SHA512 100000ae2ad1275ddd1bd107992a6b4469add5da49f89dffe456f5aecc46edf8c863069488cfc48621fe5d734213cc3f0aae586f44cef87f8fafe4c2e13475ab
- SSDEEP 196608:+pxrLLQ8TE+rOVhRj15/GgLkJSnm8UAdmap3x8wrdBUx:+pxM8DOHRjPGg/UAdRZx8wrdOx
- TLSH T1B0863341738862FFC1B1EC329F06EB825176D7EA1120AF474A992D181ED33BA77435DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\FirewallQueue
-
inject_dll
%windir%\SysWOW64\input.dll
xor.hex
xor.hex
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 2 IoCs
resource yara_rule behavioral1/files/0x00070000000243f8-31.dat family_hijackloader behavioral1/files/0x000700000002440f-90.dat family_hijackloader - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation Setup.exe - Executes dropped EXE 3 IoCs
pid Process 2524 Build_Electro.exe 3328 Build_Electro.exe 684 Build_Electro.exe - Loads dropped DLL 17 IoCs
pid Process 2524 Build_Electro.exe 2524 Build_Electro.exe 2524 Build_Electro.exe 2524 Build_Electro.exe 3328 Build_Electro.exe 3328 Build_Electro.exe 3328 Build_Electro.exe 3328 Build_Electro.exe 684 Build_Electro.exe 684 Build_Electro.exe 684 Build_Electro.exe 684 Build_Electro.exe 684 Build_Electro.exe 4536 VirtuaController.exe 1960 StreSimulator.exe 4776 libhost.exe 2308 libhost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1960 StreSimulator.exe - Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 684 set thread context of 4536 684 Build_Electro.exe 95 PID 3328 set thread context of 1960 3328 Build_Electro.exe 96 PID 684 set thread context of 4776 684 Build_Electro.exe 99 PID 3328 set thread context of 2308 3328 Build_Electro.exe 100 PID 4536 set thread context of 2500 4536 VirtuaController.exe 110 PID 4536 set thread context of 3960 4536 VirtuaController.exe 125 PID 4536 set thread context of 2500 4536 VirtuaController.exe 110 PID 4536 set thread context of 1912 4536 VirtuaController.exe 132 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ext.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt VirtuaController.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt VirtuaController.exe File opened for modification C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\History.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt VirtuaController.exe File opened for modification C:\Program Files\Java\jdk-1.8\jvisualvm.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt VirtuaController.exe File opened for modification C:\Program Files\dotnet\LICENSE.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt VirtuaController.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt VirtuaController.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt VirtuaController.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt VirtuaController.exe File opened for modification C:\Program Files\Java\jdk-1.8\jmc.txt VirtuaController.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt VirtuaController.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppCore\Location\Shifter\Relicensing Statement.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt VirtuaController.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\README.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt VirtuaController.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt VirtuaController.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt VirtuaController.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\com_int_helper.job libhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language libhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Build_Electro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Build_Electro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Build_Electro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VirtuaController.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language libhost.exe - System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3120 chrome.exe 4076 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315725110443714" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4536 VirtuaController.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2524 Build_Electro.exe 3328 Build_Electro.exe 3328 Build_Electro.exe 684 Build_Electro.exe 684 Build_Electro.exe 684 Build_Electro.exe 684 Build_Electro.exe 3328 Build_Electro.exe 3328 Build_Electro.exe 4776 libhost.exe 4776 libhost.exe 4776 libhost.exe 4776 libhost.exe 4776 libhost.exe 4776 libhost.exe 4776 libhost.exe 4776 libhost.exe 1960 StreSimulator.exe 1960 StreSimulator.exe 1960 StreSimulator.exe 1960 StreSimulator.exe 1960 StreSimulator.exe 1960 StreSimulator.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 2308 libhost.exe 2308 libhost.exe 2308 libhost.exe 2308 libhost.exe 2308 libhost.exe 2308 libhost.exe 2308 libhost.exe 2308 libhost.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 2500 chrome.exe 2500 chrome.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe 4536 VirtuaController.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4536 VirtuaController.exe - Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 684 Build_Electro.exe 3328 Build_Electro.exe 684 Build_Electro.exe 3328 Build_Electro.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeDebugPrivilege 4536 VirtuaController.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe Token: SeCreatePagefilePrivilege 2500 chrome.exe Token: SeShutdownPrivilege 2500 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe 2500 chrome.exe - Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 1308 wrote to memory of 2524 1308 Setup.exe 84 PID 2524 wrote to memory of 3328 2524 Build_Electro.exe 89 PID 3328 wrote to memory of 684 3328 Build_Electro.exe 91 PID 684 wrote to memory of 4536 684 Build_Electro.exe 95 PID 3328 wrote to memory of 1960 3328 Build_Electro.exe 96 PID 684 wrote to memory of 4536 684 Build_Electro.exe 95 PID 3328 wrote to memory of 1960 3328 Build_Electro.exe 96 PID 684 wrote to memory of 4776 684 Build_Electro.exe 99 PID 3328 wrote to memory of 2308 3328 Build_Electro.exe 100 PID 684 wrote to memory of 4776 684 Build_Electro.exe 99 PID 3328 wrote to memory of 2308 3328 Build_Electro.exe 100 PID 2500 wrote to memory of 2968 2500 chrome.exe 112 PID 2500 wrote to memory of 4652 2500 chrome.exe 113 PID 2500 wrote to memory of 4652 2500 chrome.exe 113 PID 2500 wrote to memory of 4076 2500 chrome.exe 114 PID 2500 wrote to memory of 1508 2500 chrome.exe 115 PID 2500 wrote to memory of 1508 2500 chrome.exe 115 PID 2500 wrote to memory of 8 2500 chrome.exe 116 PID 2500 wrote to memory of 2904 2500 chrome.exe 117 PID 2500 wrote to memory of 8 2500 chrome.exe 116 PID 2500 wrote to memory of 2904 2500 chrome.exe 117 PID 2500 wrote to memory of 1628 2500 chrome.exe 118 PID 2500 wrote to memory of 1628 2500 chrome.exe 118 PID 2500 wrote to memory of 3124 2500 chrome.exe 120 PID 2500 wrote to memory of 3124 2500 chrome.exe 120 PID 2500 wrote to memory of 3564 2500 chrome.exe 122 PID 4536 wrote to memory of 2500 4536 VirtuaController.exe 110 PID 4536 wrote to memory of 2500 4536 VirtuaController.exe 110 PID 4536 wrote to memory of 2500 4536 VirtuaController.exe 110 PID 4536 wrote to memory of 2500 4536 VirtuaController.exe 110 PID 4536 wrote to memory of 2500 4536 VirtuaController.exe 110 PID 4536 wrote to memory of 3960 4536 VirtuaController.exe 125 PID 4536 wrote to memory of 3960 4536 VirtuaController.exe 125 PID 4536 wrote to memory of 3960 4536 VirtuaController.exe 125 PID 4536 wrote to memory of 3960 4536 VirtuaController.exe 125 PID 4536 wrote to memory of 3960 4536 VirtuaController.exe 125 PID 4536 wrote to memory of 3960 4536 VirtuaController.exe 125 PID 4536 wrote to memory of 2500 4536 VirtuaController.exe 110 PID 4536 wrote to memory of 2500 4536 VirtuaController.exe 110 PID 4536 wrote to memory of 2500 4536 VirtuaController.exe 110 PID 4536 wrote to memory of 2500 4536 VirtuaController.exe 110 PID 4536 wrote to memory of 2500 4536 VirtuaController.exe 110 PID 2500 wrote to memory of 2912 2500 chrome.exe 128 PID 2500 wrote to memory of 1740 2500 chrome.exe 129 PID 2500 wrote to memory of 696 2500 chrome.exe 130 PID 4536 wrote to memory of 1912 4536 VirtuaController.exe 132 PID 4536 wrote to memory of 1912 4536 VirtuaController.exe 132 PID 4536 wrote to memory of 1912 4536 VirtuaController.exe 132 PID 4536 wrote to memory of 1912 4536 VirtuaController.exe 132 PID 4536 wrote to memory of 1912 4536 VirtuaController.exe 132 PID 4536 wrote to memory of 1912 4536 VirtuaController.exe 132 PID 2500 wrote to memory of 3120 2500 chrome.exe 135 PID 2500 wrote to memory of 64 2500 chrome.exe 136 PID 2500 wrote to memory of 1912 2500 chrome.exe 138 PID 2500 wrote to memory of 1912 2500 chrome.exe 138
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe"C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\ProgramData\FirewallQueue\Build_Electro.exeC:\ProgramData\FirewallQueue\Build_Electro.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Roaming\FirewallQueue\XFKUJONTVXW\Build_Electro.exeC:\Users\Admin\AppData\Roaming\FirewallQueue\XFKUJONTVXW\Build_Electro.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\VirtuaController.exeC:\Users\Admin\VirtuaController.exe5⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵PID:1912
-
-
-
C:\Users\Admin\AppData\Roaming\containerkernel_net5_32\libhost.exeC:\Users\Admin\AppData\Roaming\containerkernel_net5_32\libhost.exe5⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4776
-
-
-
C:\Users\Admin\AppData\Local\Temp\StreSimulator.exeC:\Users\Admin\AppData\Local\Temp\StreSimulator.exe4⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
-
C:\Users\Admin\AppData\Roaming\FirewallQueue\libhost.exeC:\Users\Admin\AppData\Roaming\FirewallQueue\libhost.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2308
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding1⤵PID:4460
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1484
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xf4,0x12c,0x7ff93851c728,0x7ff93851c734,0x7ff93851c7402⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,2031549446510709652,13102713990618117018,262144 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2020 /prefetch:22⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,9280607672429129535,18361373972283307006,524288 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:32⤵
- System Time Discovery
PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,11469734102256948441,4108904902611010414,524288 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2404 /prefetch:82⤵PID:1508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,8753681926950102111,12215585412261983619,2097152 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:8
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,1067150298089747232,766715513414854793,2097152 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:2904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4360,i,17746536656970496137,10877577911498215990,2097152 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:22⤵PID:1628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,12302106163144136680,744110805532911321,2097152 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4300 /prefetch:12⤵PID:3124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,16562906457942183671,10537307168340876858,524288 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:82⤵PID:3564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,13784016164633768617,7173097550240516473,524288 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:82⤵PID:2912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,15731124647906152147,1068993934827627522,524288 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:82⤵PID:1740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,7195147115422533697,929602808337343486,524288 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:82⤵PID:696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,16842568181682951028,17980750510058509300,524288 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:32⤵
- System Time Discovery
PID:3120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4488,i,13785604235792710419,15255635744424781266,262144 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:82⤵PID:64
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4452,i,14837969937594286685,11741676894543036890,524288 --field-trial-handle=2024,i,4113846443307519091,7879550199643987377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:82⤵PID:1912
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2872
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3276
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2784
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1936
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3516
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
- Size 1024KB
- SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
- MD5 34c29bdb9e41b1f47f2d2786762c12ec
- SHA1 4075131b18c3487e3e848361e112009c897629c7
- SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
- SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
- TLSH T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 3635c5b394806eab32b47e78910d47ff4ee3aff446a80fcbf11650e63a909a8f
- MD5 7ac1779e75859eeba000a9dd9dd3c421
- SHA1 e214a1302f27c5b942479ddafb87b885a7793f4f
- SHA512 7bcf3f838e9d27da769e9c37f52ee53b13b9ff686acf9e0fa6788bec476bf47591b8c04b059a5bb903a3256f54e5c0f3a44e1359fd3f5f85c3681ba0fb770a94
- TLSH T19EE02BA5C932EC3718F91729A8654746E651735B2680980F3B3D901C8FF473A418685C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 400a46716a7b7d3991cafa553404a309687076f26519215222f78bf23ccf440a
- MD5 24db3799f031fdd41846b946a4546e8a
- SHA1 a584fd37bfd0a3de40b93700b6cce954777c6ec4
- SHA512 357a23bd6c853022803bb016792fe4ad36a78f76d9f9ba043379fde11fdaf8e0526328f99337ea1b70cffb4c40d199d32c7fbf2bb7b98dc66023c3a533eb884e
- TLSH T118518BF7C3E8867DC91152F49A256E1FCD390A14021C3C6289D4AE5B47E28B2D25139E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 3a745681461f42430472a48724f904b0719e4e97bed38b776dc430a1d4bb6865
- MD5 e73e279c2623520e3b94fed1455f98b5
- SHA1 3acdf7e72cc049e963dfb41e0f641d548d714b68
- SHA512 800d0d7f73707d1c76aaa59bd32276333689adf81134050b33aeda9bea6bd74093235423c0475ab672717fd7ba58aa8ed7436489f68d50c7b2179f3e5e20e795
- SSDEEP 192:xRzrndQGAmhCv7MF+pAPRp2S9HHsb+WNneP0JLeR2aaVyIsnAUgtaJ:xRzrxOgoUX91w40u2aa8
- TLSH T1B242A52EAE11697B6CDBD229FD227B43D7F5102131C51E80EAFC992C15E76CC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
- MD5 73285efb9f7ee0bd384426865ccccf8e
- SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
- SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
- SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
- TLSH T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 f69ac621203dcc164661fe32cf77d4214f0fcf47a49908c63dd947b5450ee458
- MD5 a77e3c52a95adf4acbabbdbbb566daac
- SHA1 b138285af6a1795bae223ee2cfcebd930ed19863
- SHA512 f64a462e76bbed6be59e846230a9112270122e91805270999437928010d74b5104f21d3c191e4893cd6c89c8ad1254142e4f7bb7a4fe030b5b2b7d741c73a66e
- TLSH T1BBB01200C0115101C06306B4114294C871145F309A0B170683E8A937CC353A28418050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe598534.TMP
- Size 96B
- SHA256 fb7b81fbf9af2ca4b72e094f385b54feed981318cdf476130cbfc632136423e2
- MD5 f4f576289479e96f12676ef9ba02836e
- SHA1 8359edb663c929afef370a9709b26b7941ff2a07
- SHA512 dc30e9be9dc03c6299cf2bedf8659a979959c5e499b9f82939bb0b5facfe6fe2699cc2e43ae1710bfd28ab074e2de42e16e7c8047acee5be232e758bb1c5b456
- TLSH T107B02200C0022302C08203B02280C0C830A2CF20C303320382E00EA2CC38FB0003E0A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
- Size 106B
- SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
- MD5 de9ef0c5bcc012a3a1131988dee272d8
- SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
- SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
- TLSH T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
- Size 13B
- SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
- MD5 43ef949d3c6e9956545979ace65d0085
- SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
- SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 241KB
- SHA256 bc65f678c9f246e494e0a0b10b480c64db024721c5423d85101ba4c82dfe3df4
- MD5 8bc7890cfb97572c44d8a0903662a79f
- SHA1 8ef0d9c1cbd77b78b908e68f08ee88d16d98cde7
- SHA512 d66a17db35728f405c551d98ee678381cb55265aaa6aa9c53343f61ee70fd579a3aef9889e4ebcde586e991f68727cb2f18aa4d61f1f808b81cf7907423d9aa3
- SSDEEP 6144:rooiwfOqi+91Nd3it2um7Rkm1tYpBeh2BAoZ:rawfOqi01Nd3it2p9oBGcAoZ
- TLSH T12934233BCC60AE7A98E97F4EB14E191A4DF08FA7D424C68684E93E41335D7D85B06C78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 240KB
- SHA256 725f2462d6ac2b91d9fbbb55078169c8c8602b528d91ca1d9b874ecfd4dd5f38
- MD5 c0e6f0c837eafba1b54b13f913944595
- SHA1 269a88a3ae52eb8dd2ce35663ef3eb0c5373c0f6
- SHA512 f80e5f80a6457115b332dbe5b3b41042d425505c87509d1a520db8c11e8020f0abc9adba06cb2efad0780d183eb51f29ff05c1ee126b6cf806920dfac4cc0636
- SSDEEP 6144:DbiwfOqi+91Nd3it2um7Rkm1tYpBeh2BAoZ:DOwfOqi01Nd3it2p9oBGcAoZ
- TLSH T1DE342337CC60AE7A94AD7B4EB18E191E89F04FA7D420C78685E96F4133587CC5706D78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 241KB
- SHA256 aecb7a0a9c24e257c61b2ff8a45735125bab9326b11fd44514f7e6e0b157c436
- MD5 20e75e38338ba250047c6c5540cdfa82
- SHA1 bc3640c4d07d61bbb47263350d014af63f62ff44
- SHA512 5064642e562640ac61060d2a1b905b909983a266327331d1865c232505d3f4bb25a416a45fd0691bd0afc732dd667de2a31759976fc2d9ba129f04d95ecd9305
- SSDEEP 6144:DooiwfOqi+91Nd3it2um7Rkm1tYpBeh2BAoZ:DawfOqi01Nd3it2p9oBGcAoZ
- TLSH T1B934233BCC60AE7A88E97F4EB14E191A4DF08FA7D424C68684E97E41335D7D85B06C78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 958e2f0f380a3601817cd8b133658cfaa23b1ba574ddc159a9b52f3a1cedeb6b
- MD5 0cf86fd2873605ae9abc8ec935e7e3ed
- SHA1 27339bab9cf94d326f9337070d040552a8f983f0
- SHA512 3b66756ca52c92663f5918aef1f0d68eaff580f6aa3db558464ea906a8bc6318618053f5cd0ca56ea44b4c84c809767ead5b24c1d5ef7466ef2861f2ab0f555f
- SSDEEP 3072:/KGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Nm7Rkm1tYpBeh2BAoM
- TLSH T151C312275E75E8375878BB0EB08E0B1F1EF14AA6D830DA92C8D86B0477F97CC1A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 240KB
- SHA256 48206cbb4701aa1aba1cc2a84cf2926acf84092e6e92cf9636174bc0eebfd17b
- MD5 752bb359cd20983376534a729f84c503
- SHA1 aad420b03821ee0447e8aa8f315a4e76581d914d
- SHA512 dc8d0f80e8436a31937e7fd1c1c4fddae8907219ed44be70cd312936468ba8760838d2cd47ed206e13ff39c694d83d0fba051c322099a9f002edf58a607ccbfa
- SSDEEP 6144:obiwfOqi+91Nd3it2um7Rkm1tYpBeh2BAoZ:oOwfOqi01Nd3it2p9oBGcAoZ
- TLSH T1E434233BCC60AE7A94AD7B4EB18E191E8AF04FA7D420C78684E96F4133587C85706D78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
- Size 86B
- SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
- MD5 f732dbed9289177d15e236d0f8f2ddd3
- SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
- SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
- TLSH T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
- Size 48KB
- SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
- MD5 e045e65cd8ef3d083617318874fb79ea
- SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
- SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
- SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
- TLSH T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\26B487E.tmp
- Size 9.2MB
- SHA256 d83c8e0f73958f9187e46c2ac3b3db7d046dcfdf691b390fd1740552820e2f72
- MD5 fafa16d82ac850fb201e052b171aaba1
- SHA1 8d3196a243e7aed12e0a84a706758b95b1be8962
- SHA512 e92486b72c60a4bb337676ab10b76d954f9a12f4b23b58465933aac0dd77e4b41d67f628693c7a165f67e500e275606dcf10e1f4c23aed005ca3ece9bda3b579
- SSDEEP 196608:hWBHrLhjB9Y131Xhi3IMvM6Sf2dq/Qr7pg/aHvOzNkgpSHMLS6:QBLpDG2436i7Qr7mamzNkBHAS6
- TLSH T1B8A63361A2B9184FA4C3FED9951BA90D886E30F674CFCC65717C6429A2077835C9AEF0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\26B487E.tmp
- Size 9.2MB
- SHA256 929f3858f2cc34c2bacbd263b68b3efc66ed1b5dbc1e36911e3707fcd183c1e9
- MD5 424c8c1f39a9f3fca7d89195b6265d9b
- SHA1 63add5f12133eccfe52fad544f7da88d1a1cef25
- SHA512 e0020fa3e37ad3421deeba74d16530b7da94e600440421697b77a76d20ea811a59a65de981b3531cfa3b79713abe4d3d03b76486c81d1b3f162cbb3f66551543
- SSDEEP 196608:jNBHrLhjB9Y131Xhi3IMvM6Sf2dq/Qr7pg/aHvOzNkgpSHMLS6:pBLpDG2436i7Qr7mamzNkBHAS6
- TLSH T122A63361A3B9184FA4C3FED9951BA90D886E30F674CFCC65717C6429A2077835C9AEF0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\3C25697.tmp
- Size 4.5MB
- SHA256 ec0a75b28cef4a2aacf7376a83870298b06126438e9315c779b50810070af55c
- MD5 ba139c971acf4269970ac797aef399f8
- SHA1 d2b85d5dcaa115f4bf947cbb2098c657205270ed
- SHA512 9d52cd916a940b0b22ce2cdf215b5db8d7b1abb91fa57a135bcb4276fad8235940a0531d5f6241ec6ba2cc5acc85f79278a7ab941074a41cd25b5d3e6d078b82
- SSDEEP 98304:eBIDrqqKBJI+HGH+v3heX/xVxv+y6A2iwkRtwLYBph47FJs0:eW6NjmHyOsy6uwkRtwLg47/s0
- TLSH T19C2633DA801EF322D28D4DEFDD79234A7D4EF1EB941E59CECA5812153CA7386C1D18A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\3C25697.tmp
- Size 4.5MB
- SHA256 a64e252251e459861a531e29d8514ca2b675c35f6aa681a3a9b163c5a9e1afc9
- MD5 e05f1a83698d134a92ac33320f9d0b82
- SHA1 628c7c0fb9a990ac74a7e939da0df8d2fa18f1f3
- SHA512 672075fe96e3d9b603762f0c4232e291e058a1efe060976bf33cf41f58732300660466f606c878c1b7fe2aff2a233a829090e22b18cffeed2ecd3d7711fd8407
- SSDEEP 98304:cB1DrqqKBJI+HGH+v3heX/xVxv+y6A2iwkRtwLYBph47FJs0:cj6NjmHyOsy6uwkRtwLg47/s0
- TLSH T13C2633DA801EF322D28D4DEFDD79234A7D4EF1EB941E59CECA5812153CA7386C1D18A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\556d-2785-f584-9310.tmp
- Size 15KB
- SHA256 39279f13e0f8317b9be0d5f1bb7467de78787ace7d62baa2689b227df3d29340
- MD5 1ed8664183da9a670f070c0d0361873f
- SHA1 be78b65dcf06ead23b92e86e273f94401665f4c5
- SHA512 f1675311c5004cc8d8635223f36664be0fb41e767ddc1fcc1c02937741824ccb908692071c2befcc27a824fcb6b14aad7ef649ca8ed7ccd8f768c9c3ae220c6f
- SSDEEP 384:Xd1MqWIHIs9kcvcMDd7PXkDzk7GHGLht1Lwrq5U1WY:Xd1MxIHIejaDzfGLnhwq5U1f
- TLSH T1E772C065BD0B3B520EF5463B716ABE52F99D31E61CC386B42D851D0BA7A14CDCB03893
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7187992.tmp
- Size 40B
- SHA256 8a1e6da713c0a8b08e283104a8b9f8b556890c866338cabd3933ae43cb8b2719
- MD5 aaf6e80c254c79ca6d044017e84e1a47
- SHA1 27cde5c7d2e258d7c928990856d30250970e8ee8
- SHA512 c361390cc821d4620b6e9e187a41e398fc3474aa39b4a982f2a888d5b694e6c0b89bd9e0ca5328b54d4f61a0c90ba2ae54249c4e436486f116d7afe61300d79b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\826849E.tmp
- Size 40B
- SHA256 b75b35e729b07a1f9c1be27067df04f1793fca73c71aeceb52e7a9f27279cc78
- MD5 5e1a00f68216ad047b223d634003600e
- SHA1 95c92173ee173003249ad5d448afa6130fc1af68
- SHA512 e0ee9739b2fa8b9e97542a6a06615cfd0f3222f4780b77f104f5bf07dffbe5a2825f3c523084a6cecb099d853c6068c2260ea4d24c07528e7805a9485c074b50
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe
- Size 1.1MB
- SHA256 5c189db9f77e1678cdba8b2f896ba0188839a5a4d961a86ad11df9f286a808ee
- MD5 b5acd76504748b2dcec1b649bdff7d52
- SHA1 2695e24bbcd9700b3256d60346f7d7aa684477bf
- SHA512 d00ecd826e790f26de7be4ecc401e31bc82e6ab8abb3e71d27c56298fac46c616543f1ca5d9624fdbf925379769eb3abbaf8ce6b3abe99eb1c6fa5f7b76f2e21
- SSDEEP 24576:LKv+UYmGOSNChXpuaj1eiNfRhB9bIk7BXJI5u:Lck+jNRhBV7dJI5u
- TLSH T1B635F831F5098E3DD66043B8096EAFFE936ABD2D5BE125FF52C03A9DD0301D22935A16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSVCP140.dll
- Size 437KB
- SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
- MD5 cbf2f368dae5e7dcf338c6f63533a2a9
- SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
- SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
- SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
- TLSH T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\StreSimulator.exe
- Size 149KB
- SHA256 f0de1f321efe1f89af94beb3c4f3809a7aa04484de738e8d239ead784c7bdd6b
- MD5 7ff2f2591432a43cfdeabd86ad20c26a
- SHA1 497a8925fcc74db749a7adf80fa0e94028192330
- SHA512 e205ab23bce32833cd34013d899a5b43cb5f0e9433bc7757ecd15af67598c6ecba0912b691dc70ce5c148db53ad0963a1e3b234694db9462ba2a4ef7aa84e327
- SSDEEP 1536:tyNzqX8qRSlzlLfzhz7frLL7fXwtNM7fYP95dxsWydP9dl0MK+GBIXMhZs7pgwp:glqXELL1z7ffL7fwtNM7fu9Uvf5gLkCW
- TLSH T191E35A4773E838F8E07286749B720646E776BC350630CB6F07A4425A5F77281BE3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\krpt.dll
- Size 101KB
- SHA256 1f0e5fb35e259c8289ca7657e461f02930de30c72b017b67633b8fb84c616a8d
- MD5 a0c38e99aedfca1a2bf2e2dc543c3284
- SHA1 e4fc4956c5817546de3de22b2e1d71bc9b99b913
- SHA512 05f9db186a18f5cb093f981054b9785c872efcaea5a7880c410e203db158e6f2382d11061799f2339ddd90a4ef56bb0c84953a81aa0dc87fd010dc72684333ab
- SSDEEP 1536:4zoHW4DgoOI0c0WSvUuJ39e8mwXAv33drcsxc5dHTkb7a+A76tBNn:72e7kBUOqNr1xc5dzOWhWLl
- TLSH T1B3A35A12B9448474D96E4B7038B97B33B2BDA9289FF245C763860B877E236C63D30756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\resolverutil69.ini
- Size 7.8MB
- SHA256 69edb2acc7148213c5021fcfd2e87ad514c389d7c040fb3051ebd56565d91ba9
- MD5 3de8f3845f9875d66af3097e033f3fe9
- SHA1 93020c9df67aa26e73caf669c47f3822536ed11a
- SHA512 813c52df58e32b47d65aed37f1a8b5ca5551c72e9ac5447cca46d9f87a8c1157621398b4697354b79e24f0c617c0c3fe0c05f8102465695f1c633aca897173af
- SSDEEP 196608:sEy7pc+4Okef8iocXXj8jkRtgapqczYDQQz0DgWr3XkJHY:sEcDy882XXQjggsBYC8Y
- TLSH T1EF8633CE4C6E01EBF502627D185B44426282717E993816869BEAC5DD253DFBC2E3E70F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\spritedrv.tmp
- Size 28KB
- SHA256 056c49db2d80f11510dc5bb5ee35de023e44b0d3c3f08e0f79c884b4c0ad06e8
- MD5 70be054c9fef88cbbb5fc4cd3a57da3b
- SHA1 2132b557c0366dbc9859dddc84815d95cd7bab27
- SHA512 9878d5a5c82aee2921fc738f27955aa7542a573c14b199f13efaa986c00a8910964e4ed98b19e515e9ca275e3679b588e7d8227884c43110de18d003de23bea0
- SSDEEP 768:o1FwDHiEaYCYtGMditW3RvcfUiA1U4yUMPO:UATaJdrsmU1U4VMPO
- TLSH T154D29E7BBF996E966C5BAD264428F082C210F5FB7F0704B2F9960857B038885D15AD93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
- Size 1.1MB
- SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
- MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
- SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
- SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
- SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
- TLSH T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
- Size 89KB
- SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
- MD5 4bea1ba68690620b78c7502ac968f0ba
- SHA1 acdc523fa28632fcecede3eeaf62c6bce26527b4
- SHA512 d451625494b54b96a481d34f5b42b9c631810558267e8b37b182fe09583422f1c1171a922c9abfe4227ee91f430f3579e8ab8173234264a435fdcfa6a16ce57e
- SSDEEP 1536:WJJFW1PcUMCdLiNWNrjO+MT+S0OeneLDA50Xsd2zkkBGCGVbBBTkfeecb6RWSwgZ:I3W1P/MCdnQ+8EWXsd2ARNBPecb60Swo
- TLSH T10C937E9375F881B2D99E05B0D9BBFB161D3DE6410FF06BD71B949844DEA2BC09B3021A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\FirewallQueue\XFKUJONTVXW\resolverutil69.ini
- Size 4.2MB
- SHA256 6bdb8bc35f8a4182f289c80bd0ce88eaa1df941782a18760b1460933254d34ff
- MD5 527a8087346955c2b8d47985d6e2c1eb
- SHA1 b371e0202f81bdae78ceb43d945454d27653f53d
- SHA512 f2aadf5aed1edf60cdf7c4cf642b56fdb46fe64555a5bd6479e7280b202c243dd9490036a6f6f4892da898b633d69dee0ef6835406eb84ad6e5424674f65cbfd
- SSDEEP 98304:0Lj7OidGcEfqu0MqPhzBFUHeI3oYgBElxSYdMMaVLOCDt55u:IjNdGcsiMqZF+HeI7gBMNV+Lbtm
- TLSH T129262325E375F64EC013A139E43DE971790B2758BB7B92119731D6B20308CAED8D8EB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\containerkernel_net5_32\libhost.exe
- Size 432KB
- SHA256 3c73732dbf5dd0a75d1c909436983bfc4f20d8fa5bd9cd9a7a31e105dd2b71d9
- MD5 300414008e092e1e17ff64e831723d58
- SHA1 be381def442f9d0275c80afbc3ce1f1f646dc7de
- SHA512 60948e7357978e147073826070cee78021f2d3302145b1b4ab27065e2a57604ac34908cfdd679f388b5a16018cf64b07e0efe78a98c3883a127b52e8e8ef5a5f
- SSDEEP 6144:rxQoGR3T8fG9QAgvF6CFpTBL4Qgy9hbWYdB9zlu9BUdN99H4+29Tg:WoKjrjgvF6ChgeFd/lu9BRS
- TLSH T184947B12F1E08031D27235320A75D77689BDB4309A646ACF67D8487FAF71AC19B2672F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\VirtuaController.exe
- Size 165KB
- SHA256 92d35442715cb9c7dee115e146daa72bbb5c408ae03bb6bb5b6f834ff1867444
- MD5 259affe7b271b29d4b04d678c94bc776
- SHA1 073f326b4ce111ace97df011f8ffb78bbefcdbd2
- SHA512 e042c2ecb0f2f53a2d1555799d30aff474dfeea01033761f7f9298fa5575f5c23db5819bd850209c1b916ba3d7bd8f32a31c8b81ab9ac65a0d0a27be353aeb63
- SSDEEP 3072:xmryqHeJ22Xs/l+ehDp4kZccLd2S5S+tDOOMs+eoz3nYwPruUoR:QZ+Jzc/bWkZccLkSS+UGkYwDCR
- TLSH T1C7F37C10BBD0D0B2DAA1183495A6C7725D3ABC320B35CAC77B502F6D7E607D1AA36397
- MD5 SHA1 SHA512 SSDEEP TLSH