Analysis
- max time kernel
299s - max time network
293s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
19/08/2026, 00:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
29 signatures
300 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
29 signatures
300 seconds
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
27 signatures
300 seconds
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
300 seconds
General
- Target Setup.exe
- Size 7.6MB
- Sample260819-amfmtstdle
- SHA256 9f4e92d43db6f77fc3b5e7a764afb703ed327e595ff693bde6e03d7eb0e1cf19
- MD5 677d3e43a0ee2b00841b8e6eacb4f2b3
- SHA1 14881a228c7220a44369127c85f64071627b5f22
- SHA512 100000ae2ad1275ddd1bd107992a6b4469add5da49f89dffe456f5aecc46edf8c863069488cfc48621fe5d734213cc3f0aae586f44cef87f8fafe4c2e13475ab
- SSDEEP 196608:+pxrLLQ8TE+rOVhRj15/GgLkJSnm8UAdmap3x8wrdBUx:+pxM8DOHRjPGg/UAdRZx8wrdOx
- TLSH T1B0863341738862FFC1B1EC329F06EB825176D7EA1120AF474A992D181ED33BA77435DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\FirewallQueue
-
inject_dll
%windir%\SysWOW64\input.dll
xor.hex
xor.hex
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 2 IoCs
resource yara_rule behavioral2/files/0x000a000000028370-34.dat family_hijackloader behavioral2/files/0x0007000000028569-76.dat family_hijackloader - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation Setup.exe - Executes dropped EXE 3 IoCs
pid Process 4924 Build_Electro.exe 3124 Build_Electro.exe 3100 Build_Electro.exe - Loads dropped DLL 16 IoCs
pid Process 4924 Build_Electro.exe 4924 Build_Electro.exe 4924 Build_Electro.exe 4924 Build_Electro.exe 3124 Build_Electro.exe 3124 Build_Electro.exe 3124 Build_Electro.exe 3124 Build_Electro.exe 3100 Build_Electro.exe 3100 Build_Electro.exe 3100 Build_Electro.exe 3100 Build_Electro.exe 1736 VirtuaController.exe 1108 StreSimulator.exe 4488 libhost.exe 3584 libhost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1108 StreSimulator.exe - Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 3100 set thread context of 1736 3100 Build_Electro.exe 86 PID 3124 set thread context of 1108 3124 Build_Electro.exe 87 PID 3100 set thread context of 4488 3100 Build_Electro.exe 88 PID 3124 set thread context of 3584 3124 Build_Electro.exe 91 PID 1736 set thread context of 3132 1736 VirtuaController.exe 98 PID 1736 set thread context of 4212 1736 VirtuaController.exe 112 PID 1736 set thread context of 3132 1736 VirtuaController.exe 98 PID 1736 set thread context of 3332 1736 VirtuaController.exe 122 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\an.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt VirtuaController.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\License.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt VirtuaController.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt VirtuaController.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt VirtuaController.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt VirtuaController.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt VirtuaController.exe File opened for modification C:\Program Files\Java\jdk-1.8\jmc.txt VirtuaController.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt VirtuaController.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt VirtuaController.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt VirtuaController.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt VirtuaController.exe File opened for modification C:\Program Files\dotnet\LICENSE.txt VirtuaController.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt VirtuaController.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt VirtuaController.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt VirtuaController.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\com_int_helper.job libhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language libhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language libhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Build_Electro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Build_Electro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Build_Electro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VirtuaController.exe - System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4532 chrome.exe 3172 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315725085835165" chrome.exe - Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1736 VirtuaController.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4924 Build_Electro.exe 3124 Build_Electro.exe 3124 Build_Electro.exe 3100 Build_Electro.exe 3100 Build_Electro.exe 3100 Build_Electro.exe 3100 Build_Electro.exe 3124 Build_Electro.exe 3124 Build_Electro.exe 4488 libhost.exe 4488 libhost.exe 4488 libhost.exe 4488 libhost.exe 4488 libhost.exe 4488 libhost.exe 4488 libhost.exe 4488 libhost.exe 1108 StreSimulator.exe 1108 StreSimulator.exe 1108 StreSimulator.exe 1108 StreSimulator.exe 1108 StreSimulator.exe 1108 StreSimulator.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 3584 libhost.exe 3584 libhost.exe 3584 libhost.exe 3584 libhost.exe 3584 libhost.exe 3584 libhost.exe 3584 libhost.exe 3584 libhost.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 3132 chrome.exe 3132 chrome.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe 1736 VirtuaController.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1736 VirtuaController.exe - Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 3100 Build_Electro.exe 3124 Build_Electro.exe 3100 Build_Electro.exe 3124 Build_Electro.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeDebugPrivilege 1736 VirtuaController.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe Token: SeCreatePagefilePrivilege 3132 chrome.exe Token: SeShutdownPrivilege 3132 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe 3132 chrome.exe - Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 1816 wrote to memory of 4924 1816 Setup.exe 82 PID 4924 wrote to memory of 3124 4924 Build_Electro.exe 83 PID 3124 wrote to memory of 3100 3124 Build_Electro.exe 84 PID 3100 wrote to memory of 1736 3100 Build_Electro.exe 86 PID 3100 wrote to memory of 1736 3100 Build_Electro.exe 86 PID 3124 wrote to memory of 1108 3124 Build_Electro.exe 87 PID 3124 wrote to memory of 1108 3124 Build_Electro.exe 87 PID 3100 wrote to memory of 4488 3100 Build_Electro.exe 88 PID 3124 wrote to memory of 3584 3124 Build_Electro.exe 91 PID 3100 wrote to memory of 4488 3100 Build_Electro.exe 88 PID 3124 wrote to memory of 3584 3124 Build_Electro.exe 91 PID 3132 wrote to memory of 2592 3132 chrome.exe 100 PID 3132 wrote to memory of 928 3132 chrome.exe 102 PID 3132 wrote to memory of 4532 3132 chrome.exe 103 PID 3132 wrote to memory of 4040 3132 chrome.exe 104 PID 3132 wrote to memory of 1980 3132 chrome.exe 105 PID 3132 wrote to memory of 3352 3132 chrome.exe 106 PID 3132 wrote to memory of 928 3132 chrome.exe 102 PID 3132 wrote to memory of 4040 3132 chrome.exe 104 PID 3132 wrote to memory of 3168 3132 chrome.exe 107 PID 3132 wrote to memory of 1980 3132 chrome.exe 105 PID 3132 wrote to memory of 3352 3132 chrome.exe 106 PID 3132 wrote to memory of 3168 3132 chrome.exe 107 PID 3132 wrote to memory of 2188 3132 chrome.exe 108 PID 3132 wrote to memory of 2188 3132 chrome.exe 108 PID 3132 wrote to memory of 3584 3132 chrome.exe 109 PID 1736 wrote to memory of 3132 1736 VirtuaController.exe 98 PID 1736 wrote to memory of 3132 1736 VirtuaController.exe 98 PID 1736 wrote to memory of 3132 1736 VirtuaController.exe 98 PID 1736 wrote to memory of 3132 1736 VirtuaController.exe 98 PID 1736 wrote to memory of 3132 1736 VirtuaController.exe 98 PID 1736 wrote to memory of 4212 1736 VirtuaController.exe 112 PID 1736 wrote to memory of 4212 1736 VirtuaController.exe 112 PID 1736 wrote to memory of 4212 1736 VirtuaController.exe 112 PID 1736 wrote to memory of 4212 1736 VirtuaController.exe 112 PID 1736 wrote to memory of 4212 1736 VirtuaController.exe 112 PID 1736 wrote to memory of 4212 1736 VirtuaController.exe 112 PID 1736 wrote to memory of 3132 1736 VirtuaController.exe 98 PID 1736 wrote to memory of 3132 1736 VirtuaController.exe 98 PID 1736 wrote to memory of 3132 1736 VirtuaController.exe 98 PID 1736 wrote to memory of 3132 1736 VirtuaController.exe 98 PID 1736 wrote to memory of 3132 1736 VirtuaController.exe 98 PID 3132 wrote to memory of 4304 3132 chrome.exe 115 PID 3132 wrote to memory of 4380 3132 chrome.exe 116 PID 3132 wrote to memory of 2756 3132 chrome.exe 117 PID 3132 wrote to memory of 3172 3132 chrome.exe 121 PID 1736 wrote to memory of 3332 1736 VirtuaController.exe 122 PID 1736 wrote to memory of 3332 1736 VirtuaController.exe 122 PID 1736 wrote to memory of 3332 1736 VirtuaController.exe 122 PID 1736 wrote to memory of 3332 1736 VirtuaController.exe 122 PID 1736 wrote to memory of 3332 1736 VirtuaController.exe 122 PID 1736 wrote to memory of 3332 1736 VirtuaController.exe 122 PID 3132 wrote to memory of 1564 3132 chrome.exe 129 PID 3132 wrote to memory of 3684 3132 chrome.exe 130 PID 3132 wrote to memory of 3684 3132 chrome.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe"C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\ProgramData\FirewallQueue\Build_Electro.exeC:\ProgramData\FirewallQueue\Build_Electro.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Roaming\FirewallQueue\FYFLXVGAWIEKOM\Build_Electro.exeC:\Users\Admin\AppData\Roaming\FirewallQueue\FYFLXVGAWIEKOM\Build_Electro.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\VirtuaController.exeC:\Users\Admin\VirtuaController.exe5⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵PID:3332
-
-
-
C:\Users\Admin\AppData\Roaming\containerkernel_net5_32\libhost.exeC:\Users\Admin\AppData\Roaming\containerkernel_net5_32\libhost.exe5⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4488
-
-
-
C:\Users\Admin\AppData\Local\Temp\StreSimulator.exeC:\Users\Admin\AppData\Local\Temp\StreSimulator.exe4⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1108
-
-
C:\Users\Admin\AppData\Roaming\FirewallQueue\libhost.exeC:\Users\Admin\AppData\Roaming\FirewallQueue\libhost.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3584
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding1⤵PID:4884
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5096
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffbeab3c728,0x7ffbeab3c734,0x7ffbeab3c7402⤵PID:2592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1772,i,12088785857411671284,17721994184804153815,262144 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3400 /prefetch:22⤵PID:928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,202600183662061961,9325700282376229333,524288 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3616 /prefetch:32⤵
- System Time Discovery
PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,9877979374575535079,15975201012071749100,524288 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3732 /prefetch:82⤵PID:4040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2804,i,7424310454236335308,5857952631004533546,2097152 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3796 /prefetch:12⤵PID:1980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2808,i,2296917715395027590,6400439006583927073,2097152 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3776 /prefetch:12⤵PID:3352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3392,i,11111838659289862049,18219102995800272998,2097152 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3848 /prefetch:22⤵PID:3168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,1093570186501733394,5671300163238136233,2097152 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4652 /prefetch:12⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,14292098809069134073,561930844907870556,524288 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5368 /prefetch:82⤵PID:3584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,13530900836002520679,10577249718119499818,524288 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5716 /prefetch:82⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,5017362079557991553,6210627242097073522,524288 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5632 /prefetch:82⤵PID:4380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,7920841812099720289,737099148516088008,524288 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5776 /prefetch:82⤵PID:2756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,5853785747756972436,1172866344233114297,524288 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1616 /prefetch:32⤵
- System Time Discovery
PID:3172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5596,i,4078404645843533098,13324963933622687495,262144 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5364 /prefetch:82⤵PID:1564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,1751876108282150308,2400903191646448466,524288 --field-trial-handle=3404,i,13436187513622152454,4217528727704019373,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5780 /prefetch:82⤵PID:3684
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4004
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4188
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4272
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4884
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4332
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
- Size 1024KB
- SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
- MD5 34c29bdb9e41b1f47f2d2786762c12ec
- SHA1 4075131b18c3487e3e848361e112009c897629c7
- SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
- SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
- TLSH T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 e43a8084825dd6731fda9748239116189f0d8cf6a71c87669f2c65972f160556
- MD5 08cc7aad600cde064f6c62a71ead592d
- SHA1 3c4d751f43359e90b103b6b76b617dd52ad46cf6
- SHA512 cff731429287c8f03cacf62157bedb702a07b6b70518fa364651fb008715a6be9890fc37d74a322f0a7cf80f7fc7ad89822240b5106ef617fb784bf1a27cf394
- TLSH T1EEE02BAACC11EC2709FE1B3D58455742E654175B2B80A91F7A3CA11E4FB077A465681C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
- Size 8KB
- SHA256 e2438b2a5986f12d5e3efd51fe6aaa9b82ae521b376e2a030c0fde137b9880e4
- MD5 3a71d0d05a49f8d5f646cbe00559b1a8
- SHA1 b5354f158db3fe9200557df122c8332252c480c3
- SHA512 66d827eb183cf00c4a561ea22bfa9e2d4cfbfc654814d64fde6878427a1cf6ba8e7a75b6073b2548fd6339436230683fe2c91e34eb151b4ea59808f1e492b4d4
- SSDEEP 3:OlH/lkJwso2xbsxk1DwSK99oc1Xaldtg/PDotsWqKqK1caa+:K2qJ2xbB1kdotgPDotj
- TLSH T154022BDEC1180411CAC3E27ECE0403C883030E40FF508E05B30D8DA051303040DF0984
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
- Size 317B
- SHA256 0686d236c7eb05c1734ce79c67dd3efa536f2f74291a9a6c86748c05e568e66d
- MD5 e4c2b12a1aebb6775de8f1c2859e694b
- SHA1 43cd88de58a547aa457a956fa54dc680dadb1134
- SHA512 d5b19a16cb77cc3039c8e81e167f320d466fa8bc9ec605d7eea5861aab8cc24dd8fc9056ca9726f63a653244f74046458c6303889071daada4beec95c809f0da
- TLSH T176E0260824CBC66E5CD494638674A30CDBD2388DB2ECB98A0B8994882184904B2C5360
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
- Size 1KB
- SHA256 6ca90b9ce6dedaa698aa22b0daf569a8bc0fc5968c2fc6aec35a559e3f7ab166
- MD5 f6fc34d7da6c3afdb2c456d9be5b9938
- SHA1 6b34ddcae9f857dfb722b6df5b9656419f223e92
- SHA512 819139b3fc743cd8fa5cf7d001a8882935457b563b87c8cc86bf63ff4d7ad9e01fecd948a70468c4d44fd6700d18254a7b4362865df7e83d856f668bdc8f0944
- TLSH T10831428C2B41A726E726497E6EA393116FB0C6E003E48DDA47E58C631CD7B95235706F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
- Size 305B
- SHA256 2b1fc27bafefa3fe1a25aa61cb5538a91fe596e37632af11681a163e64b826eb
- MD5 30cda2fa93a14ca3d2809c63003fca6f
- SHA1 ebd565d6bd69938359a82a35d4034866539b8d85
- SHA512 3f577cccac4cdcf5446277c697bd6d212ce6e2d5a88c9903606ee874eccac12f5a52fa56841fa9a427a87b7cf805f1dfce04f6467b21c78322576b724ed7c077
- TLSH T1CFE0269924DFC76F2990850702B0A70CC7C8784D96FDA4C62F48684450C0C08F2C1276
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 d8bc0afb1e44663bc66fc8ba1a473f14b2c04e7817cc3fc37745a495dc087c2f
- MD5 71a9b3bf91af8e87a0825a529aaf9a04
- SHA1 a5264f0d69706461185542ef101ef25da3922dfc
- SHA512 9de7b10a6e89595f01eb9769c59c8dae1fb057ac71123e15a1aa80e638d39241005ea89397b196091aaec56b504c480f43e287d1b6dbb5bf1138f98164d02f90
- TLSH T1D13152FB537499BE8A10D2E4EA15AE1FCE790520131C78B689E46D2783F29A2D10039E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 be93b1819d79e9c376c4ab65ce56996cdd5ad524269f81c52d7724c7dc694dbf
- MD5 1c873b6abc715b01a03ef26fb7a9b6e4
- SHA1 0ef2f56e1429f156a1db50c36e3e7e0866e90a6a
- SHA512 b38c559885cb7de0fbff3e8dfc178850ea3288b6bfd11e0a77b01b3f5a2f83e9264d7bd05d3e2509d460242a59ab1768b8be1a73f8483809d73fa0ed6f822232
- SSDEEP 192:TR1Gn4tspvv7TpAPRp2v99Hsb+WNnu+dM2wP24MvkwmVyIsnAUgtaJ:TR1GJpn3UX4jwfdPwP24Ce8
- TLSH T1AD42E82EAE113A3B5CEAD22AFD627B13D3F5102125D15E88EAFCC92C15D75CC222740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 347d73ba7d38af83ac3d460ce8c2dd97cabdd4c55b65412cd8b887fb45b65b38
- MD5 871109c95d991c94717364d65631baf0
- SHA1 fc56f3d2f1b22d07cb19c827684bb9fb264712aa
- SHA512 3ade27ac0b79ef313d66bfd054d6fd2751cb9827493acd598ed9e782f0d4fcd111331893c5c70bec25cf3d8785027f9de5a781447cdf6e3bd8e08cdce6002844
- SSDEEP 384:IijUn7KxkXqKf/pUZNCgVLH2Hfgslk+n7pLuLcSjijXODUL+ErU3gRnHGmvcrBv0:IiUn7KxkXqKf/pUZNCgVLH2HfgsK+n7D
- TLSH T1A27219776C4C9E370F94C68CD8277B4FADB5025B65E9886843FA982903D5ADF010A1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 2a520c3838ad79610db1cce4e50742d01990c1692de1c5fca980dc0a827c8aed
- MD5 00718bc3673d1e2cfb28b2617609c8d8
- SHA1 5c04fda023787b87e9db2d7155265b7d31c40664
- SHA512 e4238226471d0c0a3690eccc5c3d2f002d020b3f227c577bc21dfc8b64e020c76a07fda963689812c30b493e8af28e4d83919706ef4dee860c450d8c58d617fd
- TLSH T139B0124080016142C09703F8115298CC7114DF10961E170363E0A9228825190C018050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594b38.TMP
- Size 96B
- SHA256 3bdf24f696b18887e9352124ff9dd420f203cc2d21d95fedd8c7acfebadb80fc
- MD5 353271310c26915659578b3811a86bde
- SHA1 01f05e9c8b39a9a8d94f9ec4bfc3e8b22fff9412
- SHA512 45a116752ddb828cf728fa4c0f050c02261f7a4233f543b69d1288e9d17056f71b1c49f2e52463f115c43587afd344a84a9aecd7e4d6ac1711aca443fcb5883c
- TLSH T1AEB02200C0022203C00303B0A880ABF832A0CF20CE33030A82F00AB2FC30330A0202A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
- Size 106B
- SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
- MD5 de9ef0c5bcc012a3a1131988dee272d8
- SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
- SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
- TLSH T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
- Size 13B
- SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
- MD5 43ef949d3c6e9956545979ace65d0085
- SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
- SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 241KB
- SHA256 5c39064088dc1f95d34361f4f0dcb0750f85649113107993070d6096e49bd11e
- MD5 44e496a56b5a6ee381b211a76c8354ce
- SHA1 787bfa0a1d759b9a773b38bd0f73757488f45e26
- SHA512 8b40f93076334219dc209cd870aec48633a074b9698d8e083516e74e11351b979094787b090b15f953b0b9ddd84a8a4d4a3181cdf6c2d72b613573c7351b48be
- SSDEEP 6144:jxriwfOqi+91Nd3it2I3LfqBZqenbyyVEd1cB17:jx+wfOqi01Nd3it2mLCVDuen7
- TLSH T1FD342332D895FF7A90BA2A4EB6075715CCD08AFB5455E38C05BD3F8661483C8EF26C98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 241KB
- SHA256 778477a55da35535439f34be2720897dd00893e26f1741f9a1f98d09ec2910e0
- MD5 2c6a29a48c1f04339f5fc5244471c265
- SHA1 a78a48d7eaf05cd4b7c86119a35122cd9357c8b2
- SHA512 4620eedd75f3a2b4ec673d3442ca787c33267ef84acb4f54d2b4af3da677fe07dd6f98324d62122b157fb2e44bfb66a68da1f42ae653066228c41a57e8bbe8e2
- SSDEEP 6144:HxriwfOqi+91Nd3it2I3LfqBZqenbyyVEd1cB17:Hx+wfOqi01Nd3it2mLCVDuen7
- TLSH T1E7342332D895FF7A90BA2A4EB6075715CCD08AFB5455E38C05BD3F8661483C8EF26C98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 974671bd999eea967e5ea25304187bda9fe7185982a44f97616e425f49594cc4
- MD5 06561a0fb2c3dad2d75afe46ce3a6546
- SHA1 bd53af201c00bb5722cf6a1f85f6673abf6185f0
- SHA512 96e0b1e98f7d47f306bdf26b2d3e4b3e93ac68d64330c78eacbba686566071e4a51e4e34f6ebd84a40cdd2e55ea405df81c3c25b2ebf9e09340afe794b3d6e55
- SSDEEP 3072:IxAw3LffUnBKU/F8enCW3iyVEXGey0cB12:Ixj3LfqBZqenbyyVEd1cB12
- TLSH T15FB31221E4A6FF6B9275572AB50F93295CD148FB44E1E788443C2F19E0CA388EFA8D44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 240KB
- SHA256 b996ed51cfecc9f209a28edc2825b85378a837c39740c134f3bde20d529f9e53
- MD5 0346f360d11b363cbcbb45c62e2dac27
- SHA1 e8c37409a217fb515d892f6d965f88970bab31eb
- SHA512 facf097a0f20cab3dacdb6f3ac9512dc7e46381328b891557040bf772c197e379210b75c007d736386c209df8617f0a7ca3616f0c586233b874b691aa26267e4
- SSDEEP 6144:HxciwfOqi+91Nd3it2I3LfqBZqenbyyVEd1cB17:Hx9wfOqi01Nd3it2mLCVDuen7
- TLSH T14E342333C895FF7A90AD6A5EB64B5625C9C04EFB5491938801BD3F8721493C8EB26C9C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 240KB
- SHA256 f287b85deb99b75088d20b9b82cbc8349a6e4ec954534834026e3bb53ac76355
- MD5 0aeab8986747b7f552e041634afc0d81
- SHA1 81061775444d67c66ebf50254656994b4751f624
- SHA512 041c2abea850d58f392ce12b68d9b51f94576c6923b25579071d0abb2e1364220e6c5b49de76d92ccde01d8ea3a492750006ea0fda27f10c723829ab9ab24f8d
- SSDEEP 6144:ixciwfOqi+91Nd3it2I3LfqBZqenbyyVEd1cB17:ix9wfOqi01Nd3it2mLCVDuen7
- TLSH T12C342333CC95FF7A90AD6A5EB64B5625C9C04EFB5491938801BD3F8721493C4EB26C9C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
- Size 86B
- SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
- MD5 f732dbed9289177d15e236d0f8f2ddd3
- SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
- SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
- TLSH T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
- Size 48KB
- SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
- MD5 e045e65cd8ef3d083617318874fb79ea
- SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
- SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
- SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
- TLSH T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\1FB2F1A.tmp
- Size 4.5MB
- SHA256 df3af1dc1aba20ff7aa6f4b9fb065187465f0c66dcacbe5622108b9b2b9f1c72
- MD5 925ad6e866d502effd77cdf4a640187b
- SHA1 0db789bcc882be1937b4369fe6cc9941c1109d07
- SHA512 bec6d3d860660d70014d8824ee92cc3867361902d07ff06ec441dd763f0be4a0ab3b964e222edae6673afaed8635563596becfa576e375c7e83589f3e604d083
- SSDEEP 98304:os9nuy4a3ccnfW6HYooqXia1QRLVzLjmX6hsgw2+KgDPqcWHW8O2Y4bPn+:os9bhMcnuowid1qxzhhsNKgDgHzO2YKG
- TLSH T17226332079AC7F70A7428ED93D381963D9D2A1A3C4F79E0095199BC8DEE77C1BEE2540
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\1FB2F1A.tmp
- Size 4.5MB
- SHA256 873e5cd4cf1aee0604a3e58a0e2cfe2432691d2e52b81f154a051477d9f03418
- MD5 14db7432a39f05897a7e1a04c079018c
- SHA1 4d107ad27e23ff73c1012818e83ecd17c2bbd64f
- SHA512 f728bd0d978dddc1ce399a5746be84318a9a0061af6fecbf5ba5ed9078ff31744b3eb75572a76e7c1edb621e1c9305cc97b76356d89af8a22e472b8dbd1ec39f
- SSDEEP 98304:uq9nuy4a3ccnfW6HYooqXia1QRLVzLjmX6hsgw2+KgDPqcWHW8O2Y4bPn+:uq9bhMcnuowid1qxzhhsNKgDgHzO2YKG
- TLSH T15A26332079AC7F70A7428ED93D381963D9D2A1A3C4F79E0095199BC8DEE77C1BEE2540
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2FE4E6B.tmp
- Size 40B
- SHA256 5abe4a0b744ac1dfff58b925105c8734a3bb5aa3c07fbd61d93a9be560305cdb
- MD5 1eeffc3fba9ef7ec50b53264eb8d0cba
- SHA1 5f049c883217588579b4ef17e9b920c4165986b2
- SHA512 228ee64e1d55c2554ecb5631e5a9eef851384aba2137e9a00a1da8e243ab67da0e6a33bbc100698e90821e95b1a779b4e12ff2c412cf56f68da7036e30c04297
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\4775DDC.tmp
- Size 40B
- SHA256 318ac35b5252241b8d20a768fd137b7602c90f643ec6cd2e67e3c08f537602d4
- MD5 16c48607e6be9545f189c69f1e021cb2
- SHA1 0c420cbba7ae7b46e0a41ff323e5b15356fd9cf7
- SHA512 8c788d3c9793e2f1b97e29dec3323fc4facf8eacfee0fa0989ff69083e24ee85920e89910b12fe94391cd781be29a5a5eb0fae5ac89d0996fa94211a74200261
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\8kv3.7z
- Size 18KB
- SHA256 312cb5a09b608299459cd60432f62cf82ded7f0254b78da273b4adb99f5dace3
- MD5 35b790598d378cb0124ba9ff6c58529e
- SHA1 65891855e3606785ca1f236648e64ba4dae3b228
- SHA512 d4c6f392db62f31ac291e620dc4106a244168e9db9776b6086a9182d3aeec8d521b445aed666e9a4e921dc9e1f40e5d74e2c1ae222325a3d66e7ccec5b3fbfdd
- SSDEEP 384:2V60QsnVpRT0GW7ce/a+tskWTwwMIOf4I+wNgRAQC+qIbroX8X:J0tVpOGW7ceSmsAwe4VUlQCWoXk
- TLSH T17C82E12149F583B6794F0646008C7B7784AC86B6F33455A1E7DEA81CC6F0A0E47F3A52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe
- Size 1.1MB
- SHA256 5c189db9f77e1678cdba8b2f896ba0188839a5a4d961a86ad11df9f286a808ee
- MD5 b5acd76504748b2dcec1b649bdff7d52
- SHA1 2695e24bbcd9700b3256d60346f7d7aa684477bf
- SHA512 d00ecd826e790f26de7be4ecc401e31bc82e6ab8abb3e71d27c56298fac46c616543f1ca5d9624fdbf925379769eb3abbaf8ce6b3abe99eb1c6fa5f7b76f2e21
- SSDEEP 24576:LKv+UYmGOSNChXpuaj1eiNfRhB9bIk7BXJI5u:Lck+jNRhBV7dJI5u
- TLSH T1B635F831F5098E3DD66043B8096EAFFE936ABD2D5BE125FF52C03A9DD0301D22935A16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\E952035.tmp
- Size 9.2MB
- SHA256 137d46e058c6ad8adf2ae51d9c87f113cd17e2712554fd393c8dcc8133af55d8
- MD5 8089962bbd09d05d1f00e444b8c8a61c
- SHA1 3c3bc9cb810931bb552305ec6e0c7475ff73211c
- SHA512 9f100d5e6c8377604f0bfc9ec3394d9567c23a4a5aa1867d7f6346af3c79679052741b7e07b07dd5c1c2e4eba6cd74dc1bd9aca969978d11f9d23ffeddddefc5
- SSDEEP 196608:sslbZc4lgkaNgcn3USTfSJgMlbmnkzPh0qCR5luUXwwX906q9x5rPKEpx+:s+bO4mVnD6/w+5oLXpS92EK
- TLSH T15BA6333CE1B92A13F92F7FEA54B9DC0C47F82A62A7DB62F97D1661B4045420985E73C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\E952035.tmp
- Size 9.2MB
- SHA256 ca4d751e674baa20a0b503ae3fed05cc80ff2d7baea69751c851152685c8febb
- MD5 ab445fed7e6e85bcdb3e599dd9271f7a
- SHA1 45e02f7f817e74f38c18d66ea7a4ceaa0861495b
- SHA512 751a19a57d49a3c17e89b75b54333a34dae569cab9a8ec9f22c1919f57b100f6373d29e42d39f795dd838c75a45d97cad9d8ce96924dcdfc12d1222aac659eb9
- SSDEEP 196608:W6lbZc4lgkaNgcn3USTfSJgMlbmnkzPh0qCR5luUXwwX906q9x5rPKEpx+:WAbO4mVnD6/w+5oLXpS92EK
- TLSH T1ABA6333CE1B92A13F92F7FEA54B9DC0C47F82A62A7DB62F97D1661B4045420985E73C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\StreSimulator.exe
- Size 149KB
- SHA256 f0de1f321efe1f89af94beb3c4f3809a7aa04484de738e8d239ead784c7bdd6b
- MD5 7ff2f2591432a43cfdeabd86ad20c26a
- SHA1 497a8925fcc74db749a7adf80fa0e94028192330
- SHA512 e205ab23bce32833cd34013d899a5b43cb5f0e9433bc7757ecd15af67598c6ecba0912b691dc70ce5c148db53ad0963a1e3b234694db9462ba2a4ef7aa84e327
- SSDEEP 1536:tyNzqX8qRSlzlLfzhz7frLL7fXwtNM7fYP95dxsWydP9dl0MK+GBIXMhZs7pgwp:glqXELL1z7ffL7fwtNM7fu9Uvf5gLkCW
- TLSH T191E35A4773E838F8E07286749B720646E776BC350630CB6F07A4425A5F77281BE3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\krpt.dll
- Size 101KB
- SHA256 1f0e5fb35e259c8289ca7657e461f02930de30c72b017b67633b8fb84c616a8d
- MD5 a0c38e99aedfca1a2bf2e2dc543c3284
- SHA1 e4fc4956c5817546de3de22b2e1d71bc9b99b913
- SHA512 05f9db186a18f5cb093f981054b9785c872efcaea5a7880c410e203db158e6f2382d11061799f2339ddd90a4ef56bb0c84953a81aa0dc87fd010dc72684333ab
- SSDEEP 1536:4zoHW4DgoOI0c0WSvUuJ39e8mwXAv33drcsxc5dHTkb7a+A76tBNn:72e7kBUOqNr1xc5dzOWhWLl
- TLSH T1B3A35A12B9448474D96E4B7038B97B33B2BDA9289FF245C763860B877E236C63D30756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\msvcp140.dll
- Size 437KB
- SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
- MD5 cbf2f368dae5e7dcf338c6f63533a2a9
- SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
- SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
- SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
- TLSH T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\resolverutil69.ini
- Size 7.8MB
- SHA256 69edb2acc7148213c5021fcfd2e87ad514c389d7c040fb3051ebd56565d91ba9
- MD5 3de8f3845f9875d66af3097e033f3fe9
- SHA1 93020c9df67aa26e73caf669c47f3822536ed11a
- SHA512 813c52df58e32b47d65aed37f1a8b5ca5551c72e9ac5447cca46d9f87a8c1157621398b4697354b79e24f0c617c0c3fe0c05f8102465695f1c633aca897173af
- SSDEEP 196608:sEy7pc+4Okef8iocXXj8jkRtgapqczYDQQz0DgWr3XkJHY:sEcDy882XXQjggsBYC8Y
- TLSH T1EF8633CE4C6E01EBF502627D185B44426282717E993816869BEAC5DD253DFBC2E3E70F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\spritedrv.tmp
- Size 28KB
- SHA256 056c49db2d80f11510dc5bb5ee35de023e44b0d3c3f08e0f79c884b4c0ad06e8
- MD5 70be054c9fef88cbbb5fc4cd3a57da3b
- SHA1 2132b557c0366dbc9859dddc84815d95cd7bab27
- SHA512 9878d5a5c82aee2921fc738f27955aa7542a573c14b199f13efaa986c00a8910964e4ed98b19e515e9ca275e3679b588e7d8227884c43110de18d003de23bea0
- SSDEEP 768:o1FwDHiEaYCYtGMditW3RvcfUiA1U4yUMPO:UATaJdrsmU1U4VMPO
- TLSH T154D29E7BBF996E966C5BAD264428F082C210F5FB7F0704B2F9960857B038885D15AD93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
- Size 1.1MB
- SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
- MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
- SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
- SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
- SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
- TLSH T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
- Size 89KB
- SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
- MD5 4bea1ba68690620b78c7502ac968f0ba
- SHA1 acdc523fa28632fcecede3eeaf62c6bce26527b4
- SHA512 d451625494b54b96a481d34f5b42b9c631810558267e8b37b182fe09583422f1c1171a922c9abfe4227ee91f430f3579e8ab8173234264a435fdcfa6a16ce57e
- SSDEEP 1536:WJJFW1PcUMCdLiNWNrjO+MT+S0OeneLDA50Xsd2zkkBGCGVbBBTkfeecb6RWSwgZ:I3W1P/MCdnQ+8EWXsd2ARNBPecb60Swo
- TLSH T10C937E9375F881B2D99E05B0D9BBFB161D3DE6410FF06BD71B949844DEA2BC09B3021A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\FirewallQueue\FYFLXVGAWIEKOM\resolverutil69.ini
- Size 4.2MB
- SHA256 6bdb8bc35f8a4182f289c80bd0ce88eaa1df941782a18760b1460933254d34ff
- MD5 527a8087346955c2b8d47985d6e2c1eb
- SHA1 b371e0202f81bdae78ceb43d945454d27653f53d
- SHA512 f2aadf5aed1edf60cdf7c4cf642b56fdb46fe64555a5bd6479e7280b202c243dd9490036a6f6f4892da898b633d69dee0ef6835406eb84ad6e5424674f65cbfd
- SSDEEP 98304:0Lj7OidGcEfqu0MqPhzBFUHeI3oYgBElxSYdMMaVLOCDt55u:IjNdGcsiMqZF+HeI7gBMNV+Lbtm
- TLSH T129262325E375F64EC013A139E43DE971790B2758BB7B92119731D6B20308CAED8D8EB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\containerkernel_net5_32\libhost.exe
- Size 432KB
- SHA256 3c73732dbf5dd0a75d1c909436983bfc4f20d8fa5bd9cd9a7a31e105dd2b71d9
- MD5 300414008e092e1e17ff64e831723d58
- SHA1 be381def442f9d0275c80afbc3ce1f1f646dc7de
- SHA512 60948e7357978e147073826070cee78021f2d3302145b1b4ab27065e2a57604ac34908cfdd679f388b5a16018cf64b07e0efe78a98c3883a127b52e8e8ef5a5f
- SSDEEP 6144:rxQoGR3T8fG9QAgvF6CFpTBL4Qgy9hbWYdB9zlu9BUdN99H4+29Tg:WoKjrjgvF6ChgeFd/lu9BRS
- TLSH T184947B12F1E08031D27235320A75D77689BDB4309A646ACF67D8487FAF71AC19B2672F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\VirtuaController.exe
- Size 165KB
- SHA256 92d35442715cb9c7dee115e146daa72bbb5c408ae03bb6bb5b6f834ff1867444
- MD5 259affe7b271b29d4b04d678c94bc776
- SHA1 073f326b4ce111ace97df011f8ffb78bbefcdbd2
- SHA512 e042c2ecb0f2f53a2d1555799d30aff474dfeea01033761f7f9298fa5575f5c23db5819bd850209c1b916ba3d7bd8f32a31c8b81ab9ac65a0d0a27be353aeb63
- SSDEEP 3072:xmryqHeJ22Xs/l+ehDp4kZccLd2S5S+tDOOMs+eoz3nYwPruUoR:QZ+Jzc/bWkZccLkSS+UGkYwDCR
- TLSH T1C7F37C10BBD0D0B2DAA1183495A6C7725D3ABC320B35CAC77B502F6D7E607D1AA36397
- MD5 SHA1 SHA512 SSDEEP TLSH