hijackloader | 9f4e92d43db6f77fc3b5e7a764afb703ed327e595ff693bde6e03d7eb0e1cf19

Analysis

max time kernel
300s
max time network
280s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 7.6MB
Sample260819-amfmtstdle
SHA256 9f4e92d43db6f77fc3b5e7a764afb703ed327e595ff693bde6e03d7eb0e1cf19
MD5 677d3e43a0ee2b00841b8e6eacb4f2b3
SHA1 14881a228c7220a44369127c85f64071627b5f22
SHA512 100000ae2ad1275ddd1bd107992a6b4469add5da49f89dffe456f5aecc46edf8c863069488cfc48621fe5d734213cc3f0aae586f44cef87f8fafe4c2e13475ab
SSDEEP 196608:+pxrLLQ8TE+rOVhRj15/GgLkJSnm8UAdmap3x8wrdBUx:+pxM8DOHRjPGg/UAdRZx8wrdOx
TLSH
T1B0863341738862FFC1B1EC329F06EB825176D7EA1120AF474A992D181ED33BA77435DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\FirewallQueue
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral4/files/0x000e00000001c583-29.dat	family_hijackloader
behavioral4/files/0x000d00000001c5a6-71.dat	family_hijackloader

Executes dropped EXE 3 IoCs

pid	Process
3952	Build_Electro.exe
3236	Build_Electro.exe
5620	Build_Electro.exe

Loads dropped DLL 15 IoCs

pid	Process
3952	Build_Electro.exe
3952	Build_Electro.exe
3952	Build_Electro.exe
3952	Build_Electro.exe
3236	Build_Electro.exe
3236	Build_Electro.exe
3236	Build_Electro.exe
5620	Build_Electro.exe
5620	Build_Electro.exe
5620	Build_Electro.exe
5620	Build_Electro.exe
5992	VirtuaController.exe
2208	StreSimulator.exe
2792	libhost.exe
5744	libhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2208	StreSimulator.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 5620 set thread context of 5992	5620	Build_Electro.exe	92
PID 3236 set thread context of 2208	3236	Build_Electro.exe	93
PID 5620 set thread context of 2792	5620	Build_Electro.exe	94
PID 3236 set thread context of 5744	3236	Build_Electro.exe	95
PID 5992 set thread context of 1976	5992	VirtuaController.exe	101
PID 5992 set thread context of 2836	5992	VirtuaController.exe	130
PID 5992 set thread context of 1976	5992	VirtuaController.exe	101
PID 5992 set thread context of 1432	5992	VirtuaController.exe	137

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	VirtuaController.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	VirtuaController.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	VirtuaController.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	VirtuaController.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	VirtuaController.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	VirtuaController.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\com_int_helper.job	libhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build_Electro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build_Electro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build_Electro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirtuaController.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1796	chrome.exe
5376	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315725057453841"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5992	VirtuaController.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3952	Build_Electro.exe
3236	Build_Electro.exe
3236	Build_Electro.exe
5620	Build_Electro.exe
5620	Build_Electro.exe
5620	Build_Electro.exe
5620	Build_Electro.exe
3236	Build_Electro.exe
3236	Build_Electro.exe
2792	libhost.exe
2792	libhost.exe
2792	libhost.exe
2792	libhost.exe
2792	libhost.exe
2792	libhost.exe
2792	libhost.exe
2792	libhost.exe
2792	libhost.exe
2208	StreSimulator.exe
2208	StreSimulator.exe
2208	StreSimulator.exe
2208	StreSimulator.exe
2208	StreSimulator.exe
2208	StreSimulator.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5744	libhost.exe
5744	libhost.exe
5744	libhost.exe
5744	libhost.exe
5744	libhost.exe
5744	libhost.exe
5744	libhost.exe
5744	libhost.exe
5744	libhost.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
1976	chrome.exe
1976	chrome.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe
5992	VirtuaController.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5992	VirtuaController.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
5620	Build_Electro.exe
3236	Build_Electro.exe
5620	Build_Electro.exe
3236	Build_Electro.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeDebugPrivilege	5992	VirtuaController.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe
Token: SeCreatePagefilePrivilege	1976	chrome.exe
Token: SeShutdownPrivilege	1976	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe
1976	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 3952	3352	Setup.exe	89
PID 3952 wrote to memory of 3236	3952	Build_Electro.exe	90
PID 3236 wrote to memory of 5620	3236	Build_Electro.exe	91
PID 5620 wrote to memory of 5992	5620	Build_Electro.exe	92
PID 5620 wrote to memory of 5992	5620	Build_Electro.exe	92
PID 3236 wrote to memory of 2208	3236	Build_Electro.exe	93
PID 3236 wrote to memory of 2208	3236	Build_Electro.exe	93
PID 5620 wrote to memory of 2792	5620	Build_Electro.exe	94
PID 3236 wrote to memory of 5744	3236	Build_Electro.exe	95
PID 5620 wrote to memory of 2792	5620	Build_Electro.exe	94
PID 3236 wrote to memory of 5744	3236	Build_Electro.exe	95
PID 1976 wrote to memory of 264	1976	chrome.exe	102
PID 1976 wrote to memory of 3024	1976	chrome.exe	104
PID 1976 wrote to memory of 5376	1976	chrome.exe	105
PID 1976 wrote to memory of 3024	1976	chrome.exe	104
PID 1976 wrote to memory of 1780	1976	chrome.exe	106
PID 1976 wrote to memory of 1780	1976	chrome.exe	106
PID 1976 wrote to memory of 1568	1976	chrome.exe	107
PID 1976 wrote to memory of 1568	1976	chrome.exe	107
PID 1976 wrote to memory of 3268	1976	chrome.exe	108
PID 1976 wrote to memory of 3268	1976	chrome.exe	108
PID 1976 wrote to memory of 2356	1976	chrome.exe	109
PID 1976 wrote to memory of 2356	1976	chrome.exe	109
PID 1976 wrote to memory of 2764	1976	chrome.exe	110
PID 1976 wrote to memory of 2764	1976	chrome.exe	110
PID 5992 wrote to memory of 1976	5992	VirtuaController.exe	101
PID 5992 wrote to memory of 1976	5992	VirtuaController.exe	101
PID 5992 wrote to memory of 1976	5992	VirtuaController.exe	101
PID 5992 wrote to memory of 1976	5992	VirtuaController.exe	101
PID 5992 wrote to memory of 1976	5992	VirtuaController.exe	101
PID 1976 wrote to memory of 6052	1976	chrome.exe	112
PID 1976 wrote to memory of 3016	1976	chrome.exe	114
PID 1976 wrote to memory of 5608	1976	chrome.exe	115
PID 1976 wrote to memory of 3016	1976	chrome.exe	114
PID 1976 wrote to memory of 5608	1976	chrome.exe	115
PID 1976 wrote to memory of 2680	1976	chrome.exe	116
PID 1976 wrote to memory of 2680	1976	chrome.exe	116
PID 1976 wrote to memory of 4076	1976	chrome.exe	120
PID 1976 wrote to memory of 4488	1976	chrome.exe	121
PID 1976 wrote to memory of 4076	1976	chrome.exe	120
PID 1976 wrote to memory of 4836	1976	chrome.exe	122
PID 1976 wrote to memory of 4488	1976	chrome.exe	121
PID 1976 wrote to memory of 4836	1976	chrome.exe	122
PID 1976 wrote to memory of 4200	1976	chrome.exe	123
PID 1976 wrote to memory of 6096	1976	chrome.exe	125
PID 1976 wrote to memory of 248	1976	chrome.exe	124
PID 1976 wrote to memory of 4200	1976	chrome.exe	123
PID 1976 wrote to memory of 6096	1976	chrome.exe	125
PID 1976 wrote to memory of 248	1976	chrome.exe	124
PID 1976 wrote to memory of 2972	1976	chrome.exe	127
PID 1976 wrote to memory of 3332	1976	chrome.exe	126
PID 1976 wrote to memory of 2972	1976	chrome.exe	127
PID 1976 wrote to memory of 3332	1976	chrome.exe	126
PID 1976 wrote to memory of 1804	1976	chrome.exe	128
PID 1976 wrote to memory of 1804	1976	chrome.exe	128
PID 1976 wrote to memory of 960	1976	chrome.exe	129
PID 1976 wrote to memory of 960	1976	chrome.exe	129
PID 5992 wrote to memory of 2836	5992	VirtuaController.exe	130
PID 5992 wrote to memory of 2836	5992	VirtuaController.exe	130
PID 5992 wrote to memory of 2836	5992	VirtuaController.exe	130
PID 5992 wrote to memory of 2836	5992	VirtuaController.exe	130
PID 5992 wrote to memory of 2836	5992	VirtuaController.exe	130
PID 5992 wrote to memory of 2836	5992	VirtuaController.exe	130
PID 5992 wrote to memory of 1976	5992	VirtuaController.exe	101

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe
  "C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\ProgramData\FirewallQueue\Build_Electro.exe
    C:\ProgramData\FirewallQueue\Build_Electro.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Users\Admin\AppData\Roaming\FirewallQueue\WKDVABILRHYDTML\Build_Electro.exe
      C:\Users\Admin\AppData\Roaming\FirewallQueue\WKDVABILRHYDTML\Build_Electro.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:5620
    - - C:\Users\Admin\VirtuaController.exe
        
        C:\Users\Admin\VirtuaController.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5992
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:2836
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:1432
    - - C:\Users\Admin\AppData\Roaming\containerkernel_net5_32\libhost.exe
        
        C:\Users\Admin\AppData\Roaming\containerkernel_net5_32\libhost.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\StreSimulator.exe
      C:\Users\Admin\AppData\Local\Temp\StreSimulator.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:2208
  - - C:\Users\Admin\AppData\Roaming\FirewallQueue\libhost.exe
      C:\Users\Admin\AppData\Roaming\FirewallQueue\libhost.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:1904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x12c,0x130,0x128,0x134,0x7ffa9280c728,0x7ffa9280c734,0x7ffa9280c740
  2⤵
  PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,6529467386499731907,4099824299335742975,262144 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,17124452943988301366,16706355723989305479,524288 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,1116663112268505222,16451346639721602530,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,8956355866930398415,8851331817864733426,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,12773010536108121592,1375741021796547093,524288 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,8846110033178596897,1730727784176788700,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,18017481469429688971,4737696430151572678,524288 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,14570998274619437469,12938880870605272635,524288 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5924,i,4780124017950765725,2322044463079496933,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5884,i,3102932775758469924,15562689763598111997,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6256,i,13750821585757893549,18386774818308915207,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6384,i,14230025406418806873,5649441290417441193,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6344,i,9241919393568504865,5150135753564560031,524288 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6332,i,2283244907852286658,12669419206534144015,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6268,i,14537540929552168002,5079295017410772463,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,6556776116932562416,9544346748138026042,524288 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5732,i,5137195877634972368,1160738814564664103,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,2343479908181113186,15909736126287103479,524288 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6184,i,6604602198640595462,4784166295550366944,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6564,i,12488028097933790478,7128723309563750019,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6064,i,13712898167474702523,10463271392829552627,2097152 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:9
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,4460124208894280806,16731664736259609040,524288 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,2114354388985868952,10662010268412355617,524288 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,9795660165746262467,1666834554454700598,524288 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,6729421842896735031,1866403545689295724,524288 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5584,i,11166542072388948819,11185921005702204501,262144 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:10
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,11833977675068121609,13950346821213456620,524288 --field-trial-handle=2064,i,6447056467289174974,2533025893973669393,262144 --variations-seed-version --mojo-platform-channel-handle=1528 /prefetch:14
  2⤵
  PID:5328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4172

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 69f97e0d4cf17cb6837614fcdc535230311effa6f5809dbdb18d14abbd27d6d3
MD5 147468ed1f29cd7e0a4cedeb36494844
SHA1 71a8423c308aa9697f1777765e4c3c18dac8a82c
SHA512 3dc6bf08aad50d4e75d75adb6da40bff97a71e411e2a907491e446a1e51bc88616a4d8ed401d68ab44ba8c38f67d7d103bbd7b5d86ef9b8074052bbeff4693c3
TLSH
T14F518BBBC3E8867DC85556E4DB256E2FCD390A18121C3C2288D8AE5B53E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3b2907b15d28a1eaa682a4eb1c8bc233ba1c7b69a38dce7b99fb86b945a77b5e
MD5 02f585a4137e8cf1713958c2b966af06
SHA1 0e9c570f9dd287f7d91f7d5331e7d83ff8700d92
SHA512 ca71474addb918a39be5ccb1c2ff3d2c6f644edbf761fce9af9e657278c945dea87a33c9e92737137939f8093cc19576cf023f089914a692ba006e5e980aea0d
SSDEEP 192:kRJdb4zP1v7sAPRp2X964Hsb+WNnOF09kmEmhRkwanol+VyIsnAUgR:kRJVgFBXUbwQ0iJeaol2R
TLSH
T13032A73EB964797B6DCBD329F9263A53E7F5102225902E84E7FC892C14E36CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b682460aacb36cdd3a27e77579f35c84f1bbb4aedfd3277ca88fffc5ee160e20
MD5 905520a1d523da5a33bca37a414e8d51
SHA1 62a6ad5357206cf828983aeec8263d68e8f49e8e
SHA512 ac7bbf99e4c9b8e8e5870644d7977836141408b461e7f6d9a5935821be9c1946a96753790755d64b7d09710e998e2f73589df67028bc886c34cc86390d956e41
SSDEEP 192:kRJdb4zP1v7sRPRpxX964Hsb+WNnOF0jkmEmhRkwan8l+VyIsnAUgE:kRJVgFmXBbwQ0gJea8l2E
TLSH
T16942B73EB964697B6DCBD329F9267B53E7F5102221A02E84E7FC892C15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 c46e9b2bf07447647dc4c1575b07568bb95aadbde15a6c5d276ba44703ead3ac
MD5 eebd729444a8fba93f68c290f04ef44b
SHA1 737b032c172c8582f396eb99576f312002c2aa9a
SHA512 583cd08b1779a3bdc866bfebd0132d4c4129c668454a1d571c464c46a3094fb38ac859d2bb1c9b388a31b3c79ff627f57f4925cf261a4770dbf3d6521d103e9b
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN9PjCxBRqIv:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS7
TLSH
T13E32F827A48E9A3F4FD8D51CD8136F8BADF5025272280D2496FB9D0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 97f4f1630a0f0427b207b172273ce2e5c8f8953c7cba15a043ff3687ec40c446
MD5 ac18bd902aa7a522a2b29fa02c1d3e4b
SHA1 a1ac67e1a8be16d822887411da384543ef1a7ee2
SHA512 5789bc023807f6308219334a3bc56534a125eaf870d7fd06220f3cf6dc42cebb6c1e7a87f5ce9c0fe05931d963d1006b51d21e77388e3e7e3cabda047f2316e8
TLSH
T185A0022443E40422DD008378E0A29546275388161D635B0364E688489CDB5C14756900
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a9b76.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a9b76.TMP
Size 48B
SHA256 aaad18280b3893504822d64e75f5a20395faac9c0e5131e2ac026d8b33341c5c
MD5 3af461d496257974de7d84fb625065b1
SHA1 5c93e3eed54b218fc0744e5e266d536204483c7b
SHA512 248ef12db6f9dc8ff387bca044bb3ea2ad8e817403576b09a938a1271554dab0bd2a2bb7331ebc00f634dccea37f1cc1da23db754045bfd824d4624d24faa3ef
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 d2f6f566d1723dc616c0ee7dd5a3e5d43f4cb1fa0e15dac8dadc8cf86a2f1c6a
MD5 27d9eab27a1837f38623dcc57e5a661f
SHA1 9100453abd65e79bc98bc7bc58683368cf0984c9
SHA512 d8ef6dbe694dd9930f56f2bd4981588aa65d1ee79ded73ae6a0729fb84538297543ab015a3c37d3c2e38ebf3b12b1fdf2621d79745a5bbaaec501a9156d749d2
SSDEEP 3072:LioLkkOEHiSVfOhU9AWl6rArZv2mikbR82g/:LiwfOqi+91Nd3it2Q
TLSH
T189D31377CC546F79D4DE69CDF6676856C6408BAB6411838902FF2E832108BE4E323CAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 f02a7a341571d5cccc46e48832b7f6ab2b5e4cd70f9550ea2c296380a5f9cf08
MD5 72873251cdb5a375e60f2de4a1037b3d
SHA1 737e8cabf4560d7f9abe4183adb0808b8663fac4
SHA512 8344a3819bbfcc4bf3cc74524bc8700dfeaa36d7790a40acdd806b26f02fc4415dea9d46625035b12da9b88ee435a240f7094141142a7ce79d49dedb3e9f1cbe
SSDEEP 3072:oioLkkOEHiSVfOhU9AWl6rArZv2mikbR82g/:oiwfOqi+91Nd3it2Q
TLSH
T1B8D31277CC546FB994AA6CCDA2527852CD40CAAB6914A74D41FA3F831109BE8E313CAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e2eddfbaf0444f3be3a2ed1944e2af81039bc477741a919485459e10879beb15
MD5 56f8b8bc095ef052a958745262d53cd7
SHA1 a6c304f225d1a86af35b2beba15693c01737c076
SHA512 93d90bfb6d4155df05d9446b0ba61d6c23126a25601996aa82949811ed96364e6c636087daf03fd130d045d55214c48d1c3e065b70be3b9e1b621c8b5cdaab9f
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5tCDO/B6/dGyv95Sbhbb2Jv4a:gC0LA/TE57cDUDyOJUweSbhbKl
TLSH
T148A1F871B4A95AB75DB6D684F4827E83CF78A157A9226F80D8DD5F0C10E70E81382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 9f96ad8412ded28cff1f1597618bfe117ad6c02308ce2fdf4f2a90d57fd7a5ef
MD5 a67ea2d64c1fdd6a8811ccfe0601b775
SHA1 fefc02e58b9fbda2513178bbcebb7f6113730a36
SHA512 28445227b62e803cfcf8a7a3e96fc6b1e3a97fea2f8a08b63a961611682c4beec70f33c1c40ee6c635c9fdfd290f01fbd85c71926c5c1ed6a50ff26f546f896c
SSDEEP 3072:OioLkkOEHiSVfOhU9AWl6rArZv2mikbR82g/:OiwfOqi+91Nd3it2Q
TLSH
T134D31377CC546F79D4DE69CDF6666856C6408B9B6411838902FF2E832108BE4E323CAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 ffd4501c595aa03b99789c3dbbb0a363b87f935a2b59e9a6581fa135e43968bc
MD5 6225992fa1c8eef90727ed7f6b1f42b6
SHA1 4d0218595c3e654b7a853dd95d984f1941000494
SHA512 b8c24d55f3bd6519c082a6aba29beddf9949be2e94ced81843ecee92650649d15aec5909864be28fc707311fd63c5f034aa98dd55ec85743c743232264ae94d3
SSDEEP 3072:EioLkkOEHiSVfOhU9AWl6rArZv2mikbR82g/:EiwfOqi+91Nd3it2Q
TLSH
T1FAD31277CC546F79C4DE69CDF6662856C6408B9B6411878902FF2E832109BE8E323CAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 8f915ce50d53a69145f0472838b984f8d819cacd3b8be7e5485746b50ff71e68
MD5 99c283c01a178e3facb6dc46778f503b
SHA1 7585f50d902b07daf89155758ad71903a2ff2b14
SHA512 e0524e63a3496c76c576117db4f0febd3068a5ec97176dc7cd8ad3f57ae532e613c7bfaff9c8d805cd0e97e01a8a71c8c2f6c8e8709a70ba20b35e0e8da6f0b7
SSDEEP 3072:UioLkkOEHiSVfOhU9AWl6rArZv2mikbR82g/:UiwfOqi+91Nd3it2Q
TLSH
T133D31277CC546FB984AA6CCDA6537C52CD40CA9B6914A74D41FA3F832109BE8E313CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1AF9AD1.tmp

Path C:\Users\Admin\AppData\Local\Temp\1AF9AD1.tmp
Size 40B
SHA256 70364269481aa2ff7d4a49747337bf1c3827e91b1931fc8824882cf53c3addbb
MD5 da358c010673122dbd5cf56dcafda2ab
SHA1 fcedb707526e6a6774fa7ec49e12a65dd4b73320
SHA512 b40c1ae716de771e0edd5a9c832a4f463ea9e6cc7ee0b0d8e8253e41d8dfbbcf04551963b94dd42eb0d4445a531c2f5a89eae714d70cc2d14739aad6ddbb4eaf
MD5 SHA1 SHA512

Submit Download

332AAAF.tmp

Path C:\Users\Admin\AppData\Local\Temp\332AAAF.tmp
Size 40B
SHA256 28ca532cbf48a937f4137f579acaace6e9057d17dfa203ed4f70cba26a56a2cf
MD5 45d36f837e11acab8ce498a7399f1c0c
SHA1 59173cd5ca810051d39f20166d91fb75fb75d468
SHA512 6e7f05d4e74d1314837906b036ca6ed88c648e64e960cce1057755b7df03c7e9910ddcd3f657102d862cb91a222880fc8d4815e936eb362e5bcf3c76b8a3e31d
MD5 SHA1 SHA512

Submit Download

Build_Electro.exe

Path C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe
Size 1.1MB
SHA256 5c189db9f77e1678cdba8b2f896ba0188839a5a4d961a86ad11df9f286a808ee
MD5 b5acd76504748b2dcec1b649bdff7d52
SHA1 2695e24bbcd9700b3256d60346f7d7aa684477bf
SHA512 d00ecd826e790f26de7be4ecc401e31bc82e6ab8abb3e71d27c56298fac46c616543f1ca5d9624fdbf925379769eb3abbaf8ce6b3abe99eb1c6fa5f7b76f2e21
SSDEEP 24576:LKv+UYmGOSNChXpuaj1eiNfRhB9bIk7BXJI5u:Lck+jNRhBV7dJI5u
TLSH
T1B635F831F5098E3DD66043B8096EAFFE936ABD2D5BE125FF52C03A9DD0301D22935A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D6E6E31.tmp

Path C:\Users\Admin\AppData\Local\Temp\D6E6E31.tmp
Size 9.2MB
SHA256 09ea633f739a82c1907f23727d87ed030c4c34097114dcb21193c87ca7a70d0b
MD5 906506a73ca43b91e84008690e96fb65
SHA1 132f098455dc5892602d7454b0cff0eb395e6ad9
SHA512 fdce926786ff5134a6a37b5ef77cf6a7086178cbde1916470dbdc26438347e16e403c1129cc54fd8c08615448ae07fb5de18933f8d8b737123b4a2c7a4c7bb81
SSDEEP 196608:bLCy9Mvve6ACUWqZbqR3gDw9TrcN08KvpuQJbydvrQXp:bWy9MJlqby3UN0XvEQlydcZ
TLSH
T16CA633ED844CB6E2F42E4D7ED7C0F66DF55A1BBCAE2E5AC4160B21E81724546F120B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D6E6E31.tmp

Path C:\Users\Admin\AppData\Local\Temp\D6E6E31.tmp
Size 9.2MB
SHA256 2cdd2b973841719314d42d95d639149cf30a1b052b1385dbe0697de8e2fef4b1
MD5 32d7e7cd5ba49b51342a96be12aee08c
SHA1 7bc5b1854cb396ab2320323c04e14da82a86f01b
SHA512 53dfaeca7fab346925b66b9d888cd30882fc55ce76c8889b1d31f64c43a17f301300e71aaae972cb601b624356809dff8121b90e9c5fd33391335c78b3c636ab
SSDEEP 196608:55Cy9Mvve6ACUWqZbqR3gDw9TrcN08KvpuQJbydvrQXp:54y9MJlqby3UN0XvEQlydcZ
TLSH
T168A633ED844CB6E2F42E4D7ED7C0F66DF55A1BBCAE2E5AC4160B21E81724546F120B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EE37D83.tmp

Path C:\Users\Admin\AppData\Local\Temp\EE37D83.tmp
Size 4.5MB
SHA256 8e3af55c03b9541404a712dbd489782039168017f08d1f0bfeacf8c0d7905fff
MD5 5a736f2667876c00a7d434b2e02d2c54
SHA1 90b4dc36a26eb0d44954fdf721c7a6395dbbf751
SHA512 ba7767d062d154827dbae1e024e98f90a94920d57c362f94fefe7583b0ad39f15e109cef2b41bc1af37a4cbfebb5d85fa9243b27893dcc01f225478ee52b311c
SSDEEP 98304:/GUwAXF9/n/RPWt3/dOBq0YvughOnOpgsMQ9krZmKo:hLvnFWxFOBq9v1Qa2FHo
TLSH
T18E2633DED0937D875010C1A7C4D45331E307C8EF8B67A2EAD06325661BDAB33BADA985
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EE37D83.tmp

Path C:\Users\Admin\AppData\Local\Temp\EE37D83.tmp
Size 4.5MB
SHA256 d7262247f01afd2a517093564b5425fbf03ccc7cb9b62824b0c7403cd9de9f94
MD5 4c36d503a6bb8e250982f61cf1a8b295
SHA1 07fd67d361e4e0f2731f46f8a2df75240e1580d9
SHA512 d8972fd5c63d1cc38ddf42a86ba04d91e6df461c79937624b5978b1d0db10aba62ddeb1b23b8aad95b16855ca322e77298f6812e58da0f0c3e1aeda5bd884ffd
SSDEEP 98304:ZGUFAXF9/n/RPWt3/dOBq0YvughOnOpgsMQ9krZmKo:LivnFWxFOBq9v1Qa2FHo
TLSH
T1742633DED0937D875010C1A7C4D45331E307C8EF8B67A2EAD06325661BDAB33BADA985
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StreSimulator.exe

Path C:\Users\Admin\AppData\Local\Temp\StreSimulator.exe
Size 149KB
SHA256 f0de1f321efe1f89af94beb3c4f3809a7aa04484de738e8d239ead784c7bdd6b
MD5 7ff2f2591432a43cfdeabd86ad20c26a
SHA1 497a8925fcc74db749a7adf80fa0e94028192330
SHA512 e205ab23bce32833cd34013d899a5b43cb5f0e9433bc7757ecd15af67598c6ecba0912b691dc70ce5c148db53ad0963a1e3b234694db9462ba2a4ef7aa84e327
SSDEEP 1536:tyNzqX8qRSlzlLfzhz7frLL7fXwtNM7fYP95dxsWydP9dl0MK+GBIXMhZs7pgwp:glqXELL1z7ffL7fwtNM7fu9Uvf5gLkCW
TLSH
T191E35A4773E838F8E07286749B720646E776BC350630CB6F07A4425A5F77281BE3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\VCRUNTIME140.dll
Size 89KB
SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
MD5 4bea1ba68690620b78c7502ac968f0ba
SHA1 acdc523fa28632fcecede3eeaf62c6bce26527b4
SHA512 d451625494b54b96a481d34f5b42b9c631810558267e8b37b182fe09583422f1c1171a922c9abfe4227ee91f430f3579e8ab8173234264a435fdcfa6a16ce57e
SSDEEP 1536:WJJFW1PcUMCdLiNWNrjO+MT+S0OeneLDA50Xsd2zkkBGCGVbBBTkfeecb6RWSwgZ:I3W1P/MCdnQ+8EWXsd2ARNBPecb60Swo
TLSH
T10C937E9375F881B2D99E05B0D9BBFB161D3DE6410FF06BD71B949844DEA2BC09B3021A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hA9V5.7z

Path C:\Users\Admin\AppData\Local\Temp\hA9V5.7z
Size 18KB
SHA256 035d5e9a2152e4e2d2bdea5f18d1b678c2434c026f4620ebe538e9735d9652ab
MD5 c6baaf6762213df6784f6d351d069555
SHA1 b032f1313572c9cdaf9032074710343799d88ebc
SHA512 2eadcc1543d2a987ad67f9c7c3956d45f56bd358d9356502975660eb7180e582a6f8897a8635da12d069fe0d6c0b90262c59f037a688f358583a5105051b9fc6
SSDEEP 384:Nm8A0dZzFW/V38RPa9NfP56bdf8zd1y45Z6DfmA/csp2qNwjcEOHKK:Nm4dZxW/iPaTx6bdfwdT5Z6DbEhuwjdG
TLSH
T16E82E1DB892D74E501C1BCA0C12F6CBD79296CA897010B59C5DC6F185282707EE12EDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krpt.dll

Path C:\Users\Admin\AppData\Local\Temp\krpt.dll
Size 101KB
SHA256 1f0e5fb35e259c8289ca7657e461f02930de30c72b017b67633b8fb84c616a8d
MD5 a0c38e99aedfca1a2bf2e2dc543c3284
SHA1 e4fc4956c5817546de3de22b2e1d71bc9b99b913
SHA512 05f9db186a18f5cb093f981054b9785c872efcaea5a7880c410e203db158e6f2382d11061799f2339ddd90a4ef56bb0c84953a81aa0dc87fd010dc72684333ab
SSDEEP 1536:4zoHW4DgoOI0c0WSvUuJ39e8mwXAv33drcsxc5dHTkb7a+A76tBNn:72e7kBUOqNr1xc5dzOWhWLl
TLSH
T1B3A35A12B9448474D96E4B7038B97B33B2BDA9289FF245C763860B877E236C63D30756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp140.dll
Size 437KB
SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
MD5 cbf2f368dae5e7dcf338c6f63533a2a9
SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
TLSH
T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resolverutil69.ini

Path C:\Users\Admin\AppData\Local\Temp\resolverutil69.ini
Size 7.8MB
SHA256 69edb2acc7148213c5021fcfd2e87ad514c389d7c040fb3051ebd56565d91ba9
MD5 3de8f3845f9875d66af3097e033f3fe9
SHA1 93020c9df67aa26e73caf669c47f3822536ed11a
SHA512 813c52df58e32b47d65aed37f1a8b5ca5551c72e9ac5447cca46d9f87a8c1157621398b4697354b79e24f0c617c0c3fe0c05f8102465695f1c633aca897173af
SSDEEP 196608:sEy7pc+4Okef8iocXXj8jkRtgapqczYDQQz0DgWr3XkJHY:sEcDy882XXQjggsBYC8Y
TLSH
T1EF8633CE4C6E01EBF502627D185B44426282717E993816869BEAC5DD253DFBC2E3E70F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1976_345258219\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

spritedrv.tmp

Path C:\Users\Admin\AppData\Local\Temp\spritedrv.tmp
Size 28KB
SHA256 056c49db2d80f11510dc5bb5ee35de023e44b0d3c3f08e0f79c884b4c0ad06e8
MD5 70be054c9fef88cbbb5fc4cd3a57da3b
SHA1 2132b557c0366dbc9859dddc84815d95cd7bab27
SHA512 9878d5a5c82aee2921fc738f27955aa7542a573c14b199f13efaa986c00a8910964e4ed98b19e515e9ca275e3679b588e7d8227884c43110de18d003de23bea0
SSDEEP 768:o1FwDHiEaYCYtGMditW3RvcfUiA1U4yUMPO:UATaJdrsmU1U4VMPO
TLSH
T154D29E7BBF996E966C5BAD264428F082C210F5FB7F0704B2F9960857B038885D15AD93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resolverutil69.ini

Path C:\Users\Admin\AppData\Roaming\FirewallQueue\WKDVABILRHYDTML\resolverutil69.ini
Size 4.2MB
SHA256 6bdb8bc35f8a4182f289c80bd0ce88eaa1df941782a18760b1460933254d34ff
MD5 527a8087346955c2b8d47985d6e2c1eb
SHA1 b371e0202f81bdae78ceb43d945454d27653f53d
SHA512 f2aadf5aed1edf60cdf7c4cf642b56fdb46fe64555a5bd6479e7280b202c243dd9490036a6f6f4892da898b633d69dee0ef6835406eb84ad6e5424674f65cbfd
SSDEEP 98304:0Lj7OidGcEfqu0MqPhzBFUHeI3oYgBElxSYdMMaVLOCDt55u:IjNdGcsiMqZF+HeI7gBMNV+Lbtm
TLSH
T129262325E375F64EC013A139E43DE971790B2758BB7B92119731D6B20308CAED8D8EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libhost.exe

Path C:\Users\Admin\AppData\Roaming\FirewallQueue\libhost.exe
Size 432KB
SHA256 3c73732dbf5dd0a75d1c909436983bfc4f20d8fa5bd9cd9a7a31e105dd2b71d9
MD5 300414008e092e1e17ff64e831723d58
SHA1 be381def442f9d0275c80afbc3ce1f1f646dc7de
SHA512 60948e7357978e147073826070cee78021f2d3302145b1b4ab27065e2a57604ac34908cfdd679f388b5a16018cf64b07e0efe78a98c3883a127b52e8e8ef5a5f
SSDEEP 6144:rxQoGR3T8fG9QAgvF6CFpTBL4Qgy9hbWYdB9zlu9BUdN99H4+29Tg:WoKjrjgvF6ChgeFd/lu9BRS
TLSH
T184947B12F1E08031D27235320A75D77689BDB4309A646ACF67D8487FAF71AC19B2672F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VirtuaController.exe

Path C:\Users\Admin\VirtuaController.exe
Size 165KB
SHA256 92d35442715cb9c7dee115e146daa72bbb5c408ae03bb6bb5b6f834ff1867444
MD5 259affe7b271b29d4b04d678c94bc776
SHA1 073f326b4ce111ace97df011f8ffb78bbefcdbd2
SHA512 e042c2ecb0f2f53a2d1555799d30aff474dfeea01033761f7f9298fa5575f5c23db5819bd850209c1b916ba3d7bd8f32a31c8b81ab9ac65a0d0a27be353aeb63
SSDEEP 3072:xmryqHeJ22Xs/l+ehDp4kZccLd2S5S+tDOOMs+eoz3nYwPruUoR:QZ+Jzc/bWkZccLkSS+UGkYwDCR
TLSH
T1C7F37C10BBD0D0B2DAA1183495A6C7725D3ABC320B35CAC77B502F6D7E607D1AA36397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2208-116-0x00007FF6EB8C0000-0x00007FF6EBB27000-memory.dmp

Download

memory/2208-127-0x00007FF6EB8C0000-0x00007FF6EBB27000-memory.dmp

Download

memory/2208-128-0x00007FF6EB8C0000-0x00007FF6EBB27000-memory.dmp

Download

memory/2792-117-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/2792-129-0x00000000753B0000-0x0000000075402000-memory.dmp

Download

memory/3236-42-0x00000000753B0000-0x0000000075402000-memory.dmp

Download

memory/3236-43-0x00000000753B0000-0x0000000075402000-memory.dmp

Download

memory/3236-62-0x00000000753B0000-0x0000000075402000-memory.dmp

Download

memory/3236-38-0x00000000753B0000-0x0000000075402000-memory.dmp

Download

memory/3236-39-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/3236-40-0x00000000753D0000-0x00000000753D1000-memory.dmp

Download

memory/3236-75-0x00000000753D0000-0x00000000753D1000-memory.dmp

Download

memory/3236-46-0x00000000753B0000-0x0000000075402000-memory.dmp

Download

memory/3236-79-0x00000000753B0000-0x0000000075402000-memory.dmp

Download

memory/3952-30-0x0000000073C30000-0x0000000073C82000-memory.dmp

Download

memory/3952-31-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/5620-82-0x00000000753B0000-0x0000000075402000-memory.dmp

Download

memory/5620-74-0x00000000753B0000-0x0000000075402000-memory.dmp

Download

memory/5620-85-0x00000000753B0000-0x0000000075402000-memory.dmp

Download

memory/5620-77-0x00000000753B0000-0x0000000075402000-memory.dmp

Download

memory/5620-73-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/5620-72-0x00000000753B0000-0x0000000075402000-memory.dmp

Download

memory/5620-103-0x0000000000920000-0x0000000000A39000-memory.dmp

Download

memory/5744-124-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/5992-87-0x0000000001100000-0x000000000148A000-memory.dmp

Download

memory/5992-638-0x0000000001100000-0x000000000148A000-memory.dmp

Download

memory/5992-659-0x0000000001100000-0x000000000148A000-memory.dmp

Download

memory/5992-561-0x0000000001100000-0x000000000148A000-memory.dmp

Download

memory/5992-673-0x0000000001100000-0x000000000148A000-memory.dmp

Download

memory/5992-134-0x0000000001100000-0x000000000148A000-memory.dmp

Download

memory/5992-688-0x0000000001100000-0x000000000148A000-memory.dmp

Download

memory/5992-92-0x0000000001100000-0x000000000148A000-memory.dmp

Download

memory/5992-98-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/5992-218-0x0000000001100000-0x000000000148A000-memory.dmp

Download

memory/5992-733-0x0000000001100000-0x000000000148A000-memory.dmp

Download

memory/5992-736-0x0000000001100000-0x000000000148A000-memory.dmp

Download

memory/5992-746-0x0000000001100000-0x000000000148A000-memory.dmp

Download

memory/5992-108-0x0000000001100000-0x000000000148A000-memory.dmp

Download