hijackloader | 9f4e92d43db6f77fc3b5e7a764afb703ed327e595ff693bde6e03d7eb0e1cf19

Analysis

max time kernel
300s
max time network
273s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/08/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 7.6MB
Sample260819-amfmtstdle
SHA256 9f4e92d43db6f77fc3b5e7a764afb703ed327e595ff693bde6e03d7eb0e1cf19
MD5 677d3e43a0ee2b00841b8e6eacb4f2b3
SHA1 14881a228c7220a44369127c85f64071627b5f22
SHA512 100000ae2ad1275ddd1bd107992a6b4469add5da49f89dffe456f5aecc46edf8c863069488cfc48621fe5d734213cc3f0aae586f44cef87f8fafe4c2e13475ab
SSDEEP 196608:+pxrLLQ8TE+rOVhRj15/GgLkJSnm8UAdmap3x8wrdBUx:+pxM8DOHRjPGg/UAdRZx8wrdOx
TLSH
T1B0863341738862FFC1B1EC329F06EB825176D7EA1120AF474A992D181ED33BA77435DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\FirewallQueue
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral3/files/0x001d00000002b289-31.dat	family_hijackloader
behavioral3/files/0x001900000002b55e-85.dat	family_hijackloader

Executes dropped EXE 3 IoCs

pid	Process
1260	Build_Electro.exe
2364	Build_Electro.exe
2264	Build_Electro.exe

Loads dropped DLL 15 IoCs

pid	Process
1260	Build_Electro.exe
1260	Build_Electro.exe
1260	Build_Electro.exe
1260	Build_Electro.exe
2364	Build_Electro.exe
2364	Build_Electro.exe
2364	Build_Electro.exe
2264	Build_Electro.exe
2264	Build_Electro.exe
2264	Build_Electro.exe
2264	Build_Electro.exe
1224	VirtuaController.exe
1616	StreSimulator.exe
1244	libhost.exe
1228	libhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1616	StreSimulator.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2264 set thread context of 1224	2264	Build_Electro.exe	83
PID 2364 set thread context of 1616	2364	Build_Electro.exe	84
PID 2264 set thread context of 1244	2264	Build_Electro.exe	85
PID 2364 set thread context of 1228	2364	Build_Electro.exe	86
PID 1224 set thread context of 5864	1224	VirtuaController.exe	91
PID 1224 set thread context of 4824	1224	VirtuaController.exe	105
PID 1224 set thread context of 5864	1224	VirtuaController.exe	91
PID 1224 set thread context of 4716	1224	VirtuaController.exe	111

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	VirtuaController.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	VirtuaController.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	VirtuaController.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Third Party Notices.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	VirtuaController.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\com_int_helper.job	libhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build_Electro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build_Electro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build_Electro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirtuaController.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2940	chrome.exe
5352	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315725005048013"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1224	VirtuaController.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1260	Build_Electro.exe
2364	Build_Electro.exe
2364	Build_Electro.exe
2264	Build_Electro.exe
2264	Build_Electro.exe
2264	Build_Electro.exe
2264	Build_Electro.exe
2364	Build_Electro.exe
2364	Build_Electro.exe
1616	StreSimulator.exe
1616	StreSimulator.exe
1616	StreSimulator.exe
1616	StreSimulator.exe
1616	StreSimulator.exe
1616	StreSimulator.exe
1244	libhost.exe
1244	libhost.exe
1244	libhost.exe
1244	libhost.exe
1244	libhost.exe
1244	libhost.exe
1244	libhost.exe
1244	libhost.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1228	libhost.exe
1228	libhost.exe
1228	libhost.exe
1228	libhost.exe
1228	libhost.exe
1228	libhost.exe
1228	libhost.exe
1228	libhost.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
5864	chrome.exe
5864	chrome.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe
1224	VirtuaController.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1224	VirtuaController.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2264	Build_Electro.exe
2364	Build_Electro.exe
2264	Build_Electro.exe
2364	Build_Electro.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeDebugPrivilege	1224	VirtuaController.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1260	1048	Setup.exe	80
PID 1260 wrote to memory of 2364	1260	Build_Electro.exe	81
PID 2364 wrote to memory of 2264	2364	Build_Electro.exe	82
PID 2264 wrote to memory of 1224	2264	Build_Electro.exe	83
PID 2364 wrote to memory of 1616	2364	Build_Electro.exe	84
PID 2264 wrote to memory of 1224	2264	Build_Electro.exe	83
PID 2364 wrote to memory of 1616	2364	Build_Electro.exe	84
PID 2264 wrote to memory of 1244	2264	Build_Electro.exe	85
PID 2364 wrote to memory of 1228	2364	Build_Electro.exe	86
PID 2264 wrote to memory of 1244	2264	Build_Electro.exe	85
PID 2364 wrote to memory of 1228	2364	Build_Electro.exe	86
PID 5864 wrote to memory of 5904	5864	chrome.exe	92
PID 1224 wrote to memory of 5864	1224	VirtuaController.exe	91
PID 1224 wrote to memory of 5864	1224	VirtuaController.exe	91
PID 1224 wrote to memory of 5864	1224	VirtuaController.exe	91
PID 1224 wrote to memory of 5864	1224	VirtuaController.exe	91
PID 1224 wrote to memory of 5864	1224	VirtuaController.exe	91
PID 5864 wrote to memory of 2940	5864	chrome.exe	95
PID 5864 wrote to memory of 2480	5864	chrome.exe	96
PID 5864 wrote to memory of 2480	5864	chrome.exe	96
PID 5864 wrote to memory of 4888	5864	chrome.exe	97
PID 5864 wrote to memory of 4344	5864	chrome.exe	98
PID 5864 wrote to memory of 4640	5864	chrome.exe	99
PID 5864 wrote to memory of 4888	5864	chrome.exe	97
PID 5864 wrote to memory of 4344	5864	chrome.exe	98
PID 5864 wrote to memory of 4640	5864	chrome.exe	99
PID 5864 wrote to memory of 1296	5864	chrome.exe	100
PID 5864 wrote to memory of 1296	5864	chrome.exe	100
PID 5864 wrote to memory of 3760	5864	chrome.exe	101
PID 5864 wrote to memory of 3760	5864	chrome.exe	101
PID 5864 wrote to memory of 4528	5864	chrome.exe	103
PID 1224 wrote to memory of 4824	1224	VirtuaController.exe	105
PID 1224 wrote to memory of 4824	1224	VirtuaController.exe	105
PID 1224 wrote to memory of 4824	1224	VirtuaController.exe	105
PID 1224 wrote to memory of 4824	1224	VirtuaController.exe	105
PID 1224 wrote to memory of 4824	1224	VirtuaController.exe	105
PID 1224 wrote to memory of 4824	1224	VirtuaController.exe	105
PID 1224 wrote to memory of 5864	1224	VirtuaController.exe	91
PID 1224 wrote to memory of 5864	1224	VirtuaController.exe	91
PID 1224 wrote to memory of 5864	1224	VirtuaController.exe	91
PID 1224 wrote to memory of 5864	1224	VirtuaController.exe	91
PID 1224 wrote to memory of 5864	1224	VirtuaController.exe	91
PID 5864 wrote to memory of 2476	5864	chrome.exe	108
PID 5864 wrote to memory of 2184	5864	chrome.exe	109
PID 5864 wrote to memory of 1820	5864	chrome.exe	110
PID 1224 wrote to memory of 4716	1224	VirtuaController.exe	111
PID 1224 wrote to memory of 4716	1224	VirtuaController.exe	111
PID 1224 wrote to memory of 4716	1224	VirtuaController.exe	111
PID 1224 wrote to memory of 4716	1224	VirtuaController.exe	111
PID 1224 wrote to memory of 4716	1224	VirtuaController.exe	111
PID 1224 wrote to memory of 4716	1224	VirtuaController.exe	111
PID 5864 wrote to memory of 5352	5864	chrome.exe	113
PID 5864 wrote to memory of 1644	5864	chrome.exe	114
PID 5864 wrote to memory of 5716	5864	chrome.exe	115
PID 5864 wrote to memory of 5716	5864	chrome.exe	115

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe
  "C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\ProgramData\FirewallQueue\Build_Electro.exe
    C:\ProgramData\FirewallQueue\Build_Electro.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Users\Admin\AppData\Roaming\FirewallQueue\IVRZJXIDWXESB\Build_Electro.exe
      C:\Users\Admin\AppData\Roaming\FirewallQueue\IVRZJXIDWXESB\Build_Electro.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Users\Admin\VirtuaController.exe
        
        C:\Users\Admin\VirtuaController.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1224
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4824
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Roaming\containerkernel_net5_32\libhost.exe
        
        C:\Users\Admin\AppData\Roaming\containerkernel_net5_32\libhost.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\StreSimulator.exe
      C:\Users\Admin\AppData\Local\Temp\StreSimulator.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:1616
  - - C:\Users\Admin\AppData\Roaming\FirewallQueue\libhost.exe
      C:\Users\Admin\AppData\Roaming\FirewallQueue\libhost.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:5312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff8be51c728,0x7ff8be51c734,0x7ff8be51c740
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,15819277134699774256,17617912245864104209,524288 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,2905550782640293777,1413313476707869128,262144 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3412 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,6280803049705604620,3709377605561497946,524288 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3600 /prefetch:13
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2688,i,9558570839265013734,2451208533562265424,2097152 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2708,i,3124411378621931260,12612044867780549945,2097152 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3948,i,11062188084910589666,11535742633865699763,2097152 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4272 /prefetch:9
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,5215540625489560062,4886300515846877602,2097152 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,14619587513981385884,17978562888584572287,524288 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,3683530830736016294,14930171850472850971,524288 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:14
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,11125675647225236114,12633974282463399343,524288 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,1994706419602898184,16554875161126572434,524288 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,5605423538130467900,14422482593026541256,524288 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4352,i,15915313457824144803,5529147886208968615,262144 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:10
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5244,i,17886977547847287024,53952467620059865,524288 --field-trial-handle=3416,i,5197242349526026210,203225471523492286,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:5716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 698fda73e80a84f9b9d6f501e7376a2643d7afb8e08c42aabad5ac5b5da18170
MD5 e111b3b76ba3d966f69a9d304e69c2c3
SHA1 97f94a4e42421797fc810ca9b08ededc1fd7d52d
SHA512 5507351dd8fe6e6e8dfd680a476aed54292c226bbf95f5c068bfff4175c1f277c21c68cc6ba57886f1a93f270f9ee55e3599702eb537550955383fabece80054
TLSH
T1BAE022BAC835A83B0CF9575E95544B02E78417072AA0895F3B3D828DCFB523B168682C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 76e8d849796ac6a844d5f2b15b3adea031662f0ad7b7d7dfb926c9c415234091
MD5 529b61a21fd43dc2f4ddfe316add6eb2
SHA1 1a651e76e759ad36354c610b3d49d22bc7338893
SHA512 e289d983cd54d949c48ad0a5177f8949e26639f8af4f9f16e7eb5d03f7d5d61f15cd234f3189556a253aff5ed558674f127cb155e882eedfccd5ea3e968955b0
TLSH
T136518BF7D7E8896DC91156F4DB256E1FCD390A28121C3C62C8D8AF5B43E29B2D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fd4dd2cc009eb313de3b38a578ed217efedbb0849933e0d4f4fce64f09a3856a
MD5 ed28fe3c5701a91afd126fa2510844e5
SHA1 c88d770e7c2554221310f2e5422529f79704330b
SHA512 7c889a4cfdecbf606b8aa779294cbf5b5b41285f9fb9331160b281e3a104a8c3191b2c54d777cf51eaff78ea93e456c1f744265cce57d945c7a4eac62b346ce6
SSDEEP 192:tRbVn2727Bv7mpAPRp2n9EHsb+WNnDh0DGes50DafwVyIsnAUgtaJ:tRbVdRaUXAaw90ras8
TLSH
T15442E62EB924693B5DCBD329FA267753D7F6102121842E84EBFC8A2C15E76CC321711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 78f2b9e9ebc08798880cb4679beee8aef2e584a4e9691c5edb1c0165ca1273af
MD5 f3fb909317ed06709bfdddf6e293f823
SHA1 f9840b19b75e8120807aa0784c1bde6154aba029
SHA512 4bd189ef0e2f72445f5af07954ee4d6ebdcc450090a92b283a2c281a3cf530c9eff525dfd48ea12519fb7f49e455434598bbe11f388dcada8c12c9ada348e50c
SSDEEP 384:7NjnO7KxkXqKf/pUZNCgVLH2HfgslOv7pLuLcSjZkXODnq+ErU3BHHGu/n0To:7NnO7KxkXqKf/pUZNCgVLH2Hfgs8v7pU
TLSH
T18172E9A76C4C9E370F94CACCDC1A7B4FADB6024B65E9886443FA582503D5ACF114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2f2b5dff982152adea66be0da0fe7be8e88827d7336fe6d36dcdb588411b361e
MD5 9133c9655eac572d6b93dd207f7b25d9
SHA1 2c107b802c5455b183ded53d764c636e4a95efdf
SHA512 5385d1bede98c5c4f5cacfca8e7d94414ea0f6c9c16c1101ef5e1a8d5341cc2fa82d583e78ef9be5c4880d4f0a29600fe3d643c4516c23d9c7592a2c63562441
TLSH
T1D2B0120080016206C48602B451435CA8B2145F109B0B170153E0EE26CC271618014150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595ea1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595ea1.TMP
Size 96B
SHA256 c20c3d71a519fc59e28e4e683594c99a5b0eac508a074de11e8c6056f33a9c50
MD5 45f76b79a05cd772fe91db6cb0957144
SHA1 07f8171d0df2bfb85f5636dc74f5e77502d25db9
SHA512 482cd1556674d8cfeae9b1003e3f4d0f34f362513f7947f3aa85786b24d66e401c1ba3d6ee2bf8b986508e848064d94d493969061d5e08bfe57059aff2416a37
TLSH
T1F0B0228CC002A202C80203B830808CE830B0CF20CA030202C2E00AB2CC303F0202A2A0
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 efae4d1c6563980fcc6e0e948f054ee383f57331f1a50b11db4ebe38edc64fc2
MD5 8bb3029b158c11ef23d572ac00c973f9
SHA1 957c32520240ae6d9d2be16b3be9d633c13d7022
SHA512 e19c640be0c912ee34debd89a0b1e55d0948a199f79a6644361304cee2c579edaed3082254120417a9b521f8152b8ed1eb93cfb8d8ed9a7bae653a8e0c90508b
SSDEEP 6144:kXiwfOqi+91Nd3it2wm7Rkm1tYpBeh2BAoo:kywfOqi01Nd3it2D9oBGcAoo
TLSH
T10A342337CC60EE7A98B97B4DB14A191A8DF08FE7D824D78685E92E4033587CC9706D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 eb0af6f7a362fe809150393b3c57fd285e9e8c601832ed7ed3552c4325b9fc7b
MD5 4c6361ca57e3ddc8fa130def941cca1d
SHA1 a3e9612f8751b7ea25a530cb9ea11e94f61dccb6
SHA512 688e2c45c22a172f2b6684a8065cd598900b8e05d46ec796e23e4195fe77039a21a4dc822ddb255f4924c90b330bfb063a8557690fa03e961ee274ca14dda249
SSDEEP 6144:T8iwfOqi+91Nd3it2wm7Rkm1tYpBeh2BAoo:TdwfOqi01Nd3it2D9oBGcAoo
TLSH
T115342337CC60AE7994A97B8EB18E1D1E8AF04FE79420C78781E92F413358BD85706D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 1931c349d044b39042f2f8cbbae9c4ceca4d7a4ae3fb3b4fbd2ce8e610c820ab
MD5 e99d9a11bf27d3610d94a0b9780845a0
SHA1 cc65706c7fcb9f31b9c6463e036e90af63ea4574
SHA512 ed09680026824a6b698ac77d53951d18e48ffcdd5ec7a0496e24967980963531e0852dbf39328f69610061ff6582bc4555dd9bd1d4cd14a4e4bdbe651ac87c2a
SSDEEP 6144:AXiwfOqi+91Nd3it2wm7Rkm1tYpBeh2BAoo:AywfOqi01Nd3it2D9oBGcAoo
TLSH
T135342337CC60EE7A98B97B4DB14A191A8DF08FE7D824D78685E92E4033587CC9706D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0a58ef9ff3087194796673bd03af81ca071a62303b6cd8fa0da54f091677bac7
MD5 ffc40aac9758f3177ef95e3825b8628a
SHA1 733ff8f803b56ad62788006d0f9b419f93c853c7
SHA512 0ceb0b774e571c8a973751fc991fd4fd44c456f30b3361e84f5fffb1c23673591a6e8964be393755ba7dfb46f419871929ed54bec6fae7fc0c0b7bc3c84a764a
SSDEEP 3072:3QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:3bm7Rkm1tYpBeh2BAoi
TLSH
T141C3123B5E74E9375875BB4EB08E0B1E1EF149A6C930DA82C8D85B0477F97CC1905A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 225774a7db4c79a7aaee45385607de8ed2d28082051c2f97ddb5f689d10b89d7
MD5 cdb302fb536657206bbd159d60bc5b34
SHA1 16923a79422522033fb05187a50ea992bcc2ef56
SHA512 9d8bc697929e408eda179c64b15f4d8653b095937ac10777f7c533a299880eb73096ff1d2bec785d69c687fe7ef282bf46aa964243a2afd1f589cabbe9e7f9da
SSDEEP 6144:A8iwfOqi+91Nd3it2wm7Rkm1tYpBeh2BAoo:AdwfOqi01Nd3it2D9oBGcAoo
TLSH
T104342337CC60AE7994A97B8EB18E1D1E8AF04FE79424C78781E92F413358BD85706D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17A5138.tmp

Path C:\Users\Admin\AppData\Local\Temp\17A5138.tmp
Size 9.2MB
SHA256 dbdafe0abaf3fb6e084261f068ce2d989d9973346bd80ad336ce5f7d12fa7fb8
MD5 05fa39ad1b04b09014d294c1b16d1263
SHA1 a0c7d1065db7b9b84400b1dbb6e0d20fbb5ef23c
SHA512 4a4166dd8fc00971af4d8148e32070edf5294f99abee0400af9c1efa8dba68f8852924ffe3cbbd24aaff1d2616e9c98444b62322604a7537b89b8793768378a1
SSDEEP 196608:QU1GuzT+LOuiqBYvbUI+UNakmf4vuHxdHQ+C2f18LK5:hGuzT+LDon+UcTwvuLiQ
TLSH
T1ABA633FB99B7970A01E0DC428085F4665A7F9581FB1DD5F2C6F3A8C3B88B5910DF9A80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17A5138.tmp

Path C:\Users\Admin\AppData\Local\Temp\17A5138.tmp
Size 9.2MB
SHA256 41add531d5ceda065549e9a6ae623418db3e2ad8c065961833189060912b36e4
MD5 d9d189a4ccd898fd1fc85f15d328b1b4
SHA1 0189b23ab637f01ec240ddd49a3c64e408a83d7d
SHA512 9c3e6cf393595612e045f0d2ed38c032499755b252b80d7aa48f719ed5052bb17652abd4351aea25a66afa4264b2b7f279a07463e07b3313c15660923e466e77
SSDEEP 196608:6U1GuDT+LOuiqBYvbUI+UNakmf4vuHxdHQ+C2f18LK5:LGuDT+LDon+UcTwvuLiQ
TLSH
T1DEA633FB99B7970A01E0DC428085F4665A7F9581FB1DD5F2C6F3A8C3B88B5910DF9A80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2D05F42.tmp

Path C:\Users\Admin\AppData\Local\Temp\2D05F42.tmp
Size 4.5MB
SHA256 c235329c2d9c3d0c83c1a60cfe9c4f3690b2079f343a65cc67c0a37c0f11498a
MD5 bc6ff38723d813f16ce303691ee83e4e
SHA1 6ca1ec784e8d44555496237939334d206467e5b0
SHA512 24ed4955e3ad820c343f575457f2914ee9d37e18c1fd10b923583260568baa369aa4bfd4c12bb7c3d3a01cfb1e2b459bfea2fcb19792873c7974cf98bdfc8dd0
SSDEEP 98304:ZU1GuZFltKIrDGeyB0tY19pLeiNDk1ZoQOqkTAQ9Qh:ZU1GuzTKWCeyGE7LeYYoQ44
TLSH
T122263346139987CE8C7860B905E153D6DC8F165A3A459F3ACDDB83BA781D21CCCC9CAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2D05F42.tmp

Path C:\Users\Admin\AppData\Local\Temp\2D05F42.tmp
Size 4.5MB
SHA256 61bf9f9e4651a24eb428da9b714499620ee1708f6f9ff371378b15a014efcd44
MD5 ba5cf75b282bb6e5d4d536471fe57c81
SHA1 11d537269c5005f1bab4d4cad2915e2d794dcf1b
SHA512 dd26b1b426f8de89729e299261b3a5aa34cd9f320e176601f637d89d2505bf4bd3826d193eec80081a1c4defd9446a380c3c2ca1707c9845b9f4d4c82c61886a
SSDEEP 98304:DU1GuZyltKIrDGeyB0tY19pLeiNDk1ZoQOqkTAQ9Qh:DU1GuYTKWCeyGE7LeYYoQ44
TLSH
T185263346139987CE8C7860B905E153D6DC8F165A3A459F3ACDDB83BA781D21CCCC9CAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5769-c4b4-e131-7346.tmp

Path C:\Users\Admin\AppData\Local\Temp\5769-c4b4-e131-7346.tmp
Size 18KB
SHA256 722017ae05831574c408b52234428e19afa2c75516da6b7c858e1b33ced6a56a
MD5 3d477448d530391a5c7644ba0bf0b45f
SHA1 90ea7d94d3f8c3d5c62437141cafc080e743ddd8
SHA512 fb5ff95aae50313d5b887abcc3c3c0c8aa7c2e213fe11d1da052a3f20d76f67f6f8acd9fd4876718eda236b0823a604c82ec6bb2d79f59621cd2d65b19e131fa
SSDEEP 384:KdvumiHrmJFE590N8dztCdKRao+a7NB0aCrp19jUs/aj2413:K9LFE5S2dYdKMor3CVL6j2413
TLSH
T10D82D0E3E81125F670B97E342E1A94418829FF272E6403DDCED933AD664923D33B3589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6AC87BB.tmp

Path C:\Users\Admin\AppData\Local\Temp\6AC87BB.tmp
Size 40B
SHA256 fc5783334fb4536747682a3b28d5f0ec7e4f4b7e70be0b6ebf2ad084e71e84e3
MD5 138d67241a985067cf38a95add7a1be7
SHA1 4ba77928e84b91818007c6ba5d129847aaacb856
SHA512 556b706b8d93ad3899b88e0307dce1b361dfe9b37dca2159174f06d2ad891dbc997a3f60c2aa55d093460012dbea0934a5fb1ed2fce31a23328083c8b06b50e8
MD5 SHA1 SHA512

Submit Download

7758FE9.tmp

Path C:\Users\Admin\AppData\Local\Temp\7758FE9.tmp
Size 40B
SHA256 9e93667fdadfea3d3fa35bda847b0353925c90c1b996522afd4a2e6ae9629df6
MD5 5393dc37d20d3ad1cfce6d0923458207
SHA1 c4f8a4602d008d64f9b206c198b5b47de5847d62
SHA512 acc4d24a0d4c79bcc3b2c937d68f9461d0f061e8b4a662775bcf20320aa15501b206dbd1056d96a54b6064201de2eaa41488ea3f36c1a78e5fed0387f7dbfb00
MD5 SHA1 SHA512

Submit Download

Build_Electro.exe

Path C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe
Size 1.1MB
SHA256 5c189db9f77e1678cdba8b2f896ba0188839a5a4d961a86ad11df9f286a808ee
MD5 b5acd76504748b2dcec1b649bdff7d52
SHA1 2695e24bbcd9700b3256d60346f7d7aa684477bf
SHA512 d00ecd826e790f26de7be4ecc401e31bc82e6ab8abb3e71d27c56298fac46c616543f1ca5d9624fdbf925379769eb3abbaf8ce6b3abe99eb1c6fa5f7b76f2e21
SSDEEP 24576:LKv+UYmGOSNChXpuaj1eiNfRhB9bIk7BXJI5u:Lck+jNRhBV7dJI5u
TLSH
T1B635F831F5098E3DD66043B8096EAFFE936ABD2D5BE125FF52C03A9DD0301D22935A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCP140.dll
Size 437KB
SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
MD5 cbf2f368dae5e7dcf338c6f63533a2a9
SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
TLSH
T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StreSimulator.exe

Path C:\Users\Admin\AppData\Local\Temp\StreSimulator.exe
Size 149KB
SHA256 f0de1f321efe1f89af94beb3c4f3809a7aa04484de738e8d239ead784c7bdd6b
MD5 7ff2f2591432a43cfdeabd86ad20c26a
SHA1 497a8925fcc74db749a7adf80fa0e94028192330
SHA512 e205ab23bce32833cd34013d899a5b43cb5f0e9433bc7757ecd15af67598c6ecba0912b691dc70ce5c148db53ad0963a1e3b234694db9462ba2a4ef7aa84e327
SSDEEP 1536:tyNzqX8qRSlzlLfzhz7frLL7fXwtNM7fYP95dxsWydP9dl0MK+GBIXMhZs7pgwp:glqXELL1z7ffL7fwtNM7fu9Uvf5gLkCW
TLSH
T191E35A4773E838F8E07286749B720646E776BC350630CB6F07A4425A5F77281BE3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\VCRUNTIME140.dll
Size 89KB
SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
MD5 4bea1ba68690620b78c7502ac968f0ba
SHA1 acdc523fa28632fcecede3eeaf62c6bce26527b4
SHA512 d451625494b54b96a481d34f5b42b9c631810558267e8b37b182fe09583422f1c1171a922c9abfe4227ee91f430f3579e8ab8173234264a435fdcfa6a16ce57e
SSDEEP 1536:WJJFW1PcUMCdLiNWNrjO+MT+S0OeneLDA50Xsd2zkkBGCGVbBBTkfeecb6RWSwgZ:I3W1P/MCdnQ+8EWXsd2ARNBPecb60Swo
TLSH
T10C937E9375F881B2D99E05B0D9BBFB161D3DE6410FF06BD71B949844DEA2BC09B3021A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krpt.dll

Path C:\Users\Admin\AppData\Local\Temp\krpt.dll
Size 101KB
SHA256 1f0e5fb35e259c8289ca7657e461f02930de30c72b017b67633b8fb84c616a8d
MD5 a0c38e99aedfca1a2bf2e2dc543c3284
SHA1 e4fc4956c5817546de3de22b2e1d71bc9b99b913
SHA512 05f9db186a18f5cb093f981054b9785c872efcaea5a7880c410e203db158e6f2382d11061799f2339ddd90a4ef56bb0c84953a81aa0dc87fd010dc72684333ab
SSDEEP 1536:4zoHW4DgoOI0c0WSvUuJ39e8mwXAv33drcsxc5dHTkb7a+A76tBNn:72e7kBUOqNr1xc5dzOWhWLl
TLSH
T1B3A35A12B9448474D96E4B7038B97B33B2BDA9289FF245C763860B877E236C63D30756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resolverutil69.ini

Path C:\Users\Admin\AppData\Local\Temp\resolverutil69.ini
Size 7.8MB
SHA256 69edb2acc7148213c5021fcfd2e87ad514c389d7c040fb3051ebd56565d91ba9
MD5 3de8f3845f9875d66af3097e033f3fe9
SHA1 93020c9df67aa26e73caf669c47f3822536ed11a
SHA512 813c52df58e32b47d65aed37f1a8b5ca5551c72e9ac5447cca46d9f87a8c1157621398b4697354b79e24f0c617c0c3fe0c05f8102465695f1c633aca897173af
SSDEEP 196608:sEy7pc+4Okef8iocXXj8jkRtgapqczYDQQz0DgWr3XkJHY:sEcDy882XXQjggsBYC8Y
TLSH
T1EF8633CE4C6E01EBF502627D185B44426282717E993816869BEAC5DD253DFBC2E3E70F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spritedrv.tmp

Path C:\Users\Admin\AppData\Local\Temp\spritedrv.tmp
Size 28KB
SHA256 056c49db2d80f11510dc5bb5ee35de023e44b0d3c3f08e0f79c884b4c0ad06e8
MD5 70be054c9fef88cbbb5fc4cd3a57da3b
SHA1 2132b557c0366dbc9859dddc84815d95cd7bab27
SHA512 9878d5a5c82aee2921fc738f27955aa7542a573c14b199f13efaa986c00a8910964e4ed98b19e515e9ca275e3679b588e7d8227884c43110de18d003de23bea0
SSDEEP 768:o1FwDHiEaYCYtGMditW3RvcfUiA1U4yUMPO:UATaJdrsmU1U4VMPO
TLSH
T154D29E7BBF996E966C5BAD264428F082C210F5FB7F0704B2F9960857B038885D15AD93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resolverutil69.ini

Path C:\Users\Admin\AppData\Roaming\FirewallQueue\IVRZJXIDWXESB\resolverutil69.ini
Size 4.2MB
SHA256 6bdb8bc35f8a4182f289c80bd0ce88eaa1df941782a18760b1460933254d34ff
MD5 527a8087346955c2b8d47985d6e2c1eb
SHA1 b371e0202f81bdae78ceb43d945454d27653f53d
SHA512 f2aadf5aed1edf60cdf7c4cf642b56fdb46fe64555a5bd6479e7280b202c243dd9490036a6f6f4892da898b633d69dee0ef6835406eb84ad6e5424674f65cbfd
SSDEEP 98304:0Lj7OidGcEfqu0MqPhzBFUHeI3oYgBElxSYdMMaVLOCDt55u:IjNdGcsiMqZF+HeI7gBMNV+Lbtm
TLSH
T129262325E375F64EC013A139E43DE971790B2758BB7B92119731D6B20308CAED8D8EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libhost.exe

Path C:\Users\Admin\AppData\Roaming\containerkernel_net5_32\libhost.exe
Size 432KB
SHA256 3c73732dbf5dd0a75d1c909436983bfc4f20d8fa5bd9cd9a7a31e105dd2b71d9
MD5 300414008e092e1e17ff64e831723d58
SHA1 be381def442f9d0275c80afbc3ce1f1f646dc7de
SHA512 60948e7357978e147073826070cee78021f2d3302145b1b4ab27065e2a57604ac34908cfdd679f388b5a16018cf64b07e0efe78a98c3883a127b52e8e8ef5a5f
SSDEEP 6144:rxQoGR3T8fG9QAgvF6CFpTBL4Qgy9hbWYdB9zlu9BUdN99H4+29Tg:WoKjrjgvF6ChgeFd/lu9BRS
TLSH
T184947B12F1E08031D27235320A75D77689BDB4309A646ACF67D8487FAF71AC19B2672F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VirtuaController.exe

Path C:\Users\Admin\VirtuaController.exe
Size 165KB
SHA256 92d35442715cb9c7dee115e146daa72bbb5c408ae03bb6bb5b6f834ff1867444
MD5 259affe7b271b29d4b04d678c94bc776
SHA1 073f326b4ce111ace97df011f8ffb78bbefcdbd2
SHA512 e042c2ecb0f2f53a2d1555799d30aff474dfeea01033761f7f9298fa5575f5c23db5819bd850209c1b916ba3d7bd8f32a31c8b81ab9ac65a0d0a27be353aeb63
SSDEEP 3072:xmryqHeJ22Xs/l+ehDp4kZccLd2S5S+tDOOMs+eoz3nYwPruUoR:QZ+Jzc/bWkZccLkSS+UGkYwDCR
TLSH
T1C7F37C10BBD0D0B2DAA1183495A6C7725D3ABC320B35CAC77B502F6D7E607D1AA36397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-111-0x00007FF8DDA20000-0x00007FF8DDC29000-memory.dmp

Download

memory/1224-147-0x0000000000A10000-0x0000000000D9A000-memory.dmp

Download

memory/1224-193-0x0000000000A10000-0x0000000000D9A000-memory.dmp

Download

memory/1224-251-0x0000000000A10000-0x0000000000D9A000-memory.dmp

Download

memory/1224-236-0x0000000000A10000-0x0000000000D9A000-memory.dmp

Download

memory/1224-297-0x0000000000A10000-0x0000000000D9A000-memory.dmp

Download

memory/1224-299-0x0000000000A10000-0x0000000000D9A000-memory.dmp

Download

memory/1224-338-0x0000000000A10000-0x0000000000D9A000-memory.dmp

Download

memory/1224-215-0x0000000000A10000-0x0000000000D9A000-memory.dmp

Download

memory/1224-118-0x0000000000A10000-0x0000000000D9A000-memory.dmp

Download

memory/1224-103-0x0000000000A10000-0x0000000000D9A000-memory.dmp

Download

memory/1224-350-0x0000000000A10000-0x0000000000D9A000-memory.dmp

Download

memory/1224-341-0x0000000000A10000-0x0000000000D9A000-memory.dmp

Download

memory/1228-133-0x00007FF8DDA20000-0x00007FF8DDC29000-memory.dmp

Download

memory/1244-141-0x00000000751E0000-0x000000007522F000-memory.dmp

Download

memory/1244-127-0x00007FF8DDA20000-0x00007FF8DDC29000-memory.dmp

Download

memory/1260-33-0x00007FF8DDA20000-0x00007FF8DDC29000-memory.dmp

Download

memory/1260-32-0x0000000073700000-0x000000007374F000-memory.dmp

Download

memory/1616-120-0x00007FF68C810000-0x00007FF68CA77000-memory.dmp

Download

memory/1616-140-0x00007FF68C810000-0x00007FF68CA77000-memory.dmp

Download

memory/1616-137-0x00007FF68C810000-0x00007FF68CA77000-memory.dmp

Download

memory/2264-90-0x00000000751E0000-0x000000007522F000-memory.dmp

Download

memory/2264-87-0x00007FF8DDA20000-0x00007FF8DDC29000-memory.dmp

Download

memory/2264-112-0x00000000006F0000-0x0000000000809000-memory.dmp

Download

memory/2264-101-0x00000000751E0000-0x000000007522F000-memory.dmp

Download

memory/2264-97-0x00000000751E0000-0x000000007522F000-memory.dmp

Download

memory/2264-86-0x00000000751E0000-0x000000007522F000-memory.dmp

Download

memory/2264-91-0x00000000751E0000-0x000000007522F000-memory.dmp

Download

memory/2364-54-0x00007FF8DDA20000-0x00007FF8DDC29000-memory.dmp

Download

memory/2364-75-0x00000000751E0000-0x000000007522F000-memory.dmp

Download

memory/2364-55-0x0000000075200000-0x0000000075201000-memory.dmp

Download

memory/2364-53-0x00000000751E0000-0x000000007522F000-memory.dmp

Download

memory/2364-93-0x00000000751E0000-0x000000007522F000-memory.dmp

Download

memory/2364-95-0x0000000075200000-0x0000000075201000-memory.dmp

Download

memory/2364-73-0x00000000751E0000-0x000000007522F000-memory.dmp

Download

memory/2364-64-0x00000000751E0000-0x000000007522F000-memory.dmp

Download

memory/2364-57-0x00000000751E0000-0x000000007522F000-memory.dmp

Download