Analysis
- user interaction
yes - max time kernel
900s - max time network
734s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/09/2026, 10:29
Behavioral task
behavioral1
Sample
Chimera_tool.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Chimera_tool.zip
Resource
win11ltsc2024-20260709-en
General
- Target Chimera_tool.zip
- Size 15.1MB
- Sample260905-mh85ssdc49
- SHA256 2b89584d93a7bae0b2d16cc1caf77e59136abcfadef46b853ca174cb4fd9606c
- MD5 f8d73d0d7ef6cafa78d8521b99284970
- SHA1 30fc2a1763e129a6d34111119137c6de431a0eee
- SHA512 09bb1607cb172c5e73994fb7566900247a236d49df217f900a3d65765ba634b848744e31cabbee065ee757bfca20b500baddb6d1114687dfafbbaeec9d630c9f
- SSDEEP 393216:z5cQXorBW9cUxWdsY2w9u1CXWnYU/GVNk3RJXVzrjluS0Qf:zKQX799TCXWnYUuc3DXuSD
- TLSH T191F6339658F0EC780469E15F1CEA47702E2C9EBBF8ED519A7F5723CEE02567320C58A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService Chimera.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ChimeraInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Chimera.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ Chimera.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ Chimera.exe - Identifies Xen via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\xen Chimera.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\xen Chimera.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\xen Chimera.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Chimera.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools Chimera.exe - Looks for VMWare services registry key. 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmdebug Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse Chimera.exe - Looks for Xen service registry key. 1 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xennet Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xennet6 Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xensvc Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenvdb Chimera.exe - Manipulates Digital Signatures 1 TTPs 17 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC\Blob = 0300000001000000140000003f369fec1ea4b285a44f3ad935922b152d7c68ac2000000001000000640500003082056030820448a003020102020900b9a5e5882ca0467a300d06092a864886f70d01010505003081dc310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31393037060355040b1330687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083130363838343335301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019d30820199300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736673352d31362e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818d06082b06010505070101048180307e302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f305006082b060105050730028644687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73665f696e7465726d6564696174652e637274301f0603551d23041830168014494b5227d11bbcf2a1216a627b51427a8ad7d556301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d010105050003820101009b9545c0c75b4bc3e9cd82632781066973f7b0d6b9b054329f19518e75692963b629e8f8454199f3d28be28c718f7aba36fb534427d84945527d2843936433091b6d12c9792364ade245e20d1a4e18ae88f31cb210af70ab5af0718bc71417a062ef696ef77f350639220f7161ede483ae7b0038d282429768991d5479b7acb90c66d6c3631149755345436a2675934c21eef2d1014d8e6cc16fe9d775d28648a5a0fc7004d6abc9466f7a7b89fd94c8f1963596e7cdfc4520a3393a3e1381ccd128b2a480eb31cb1081864fb7cddca58d8bd2b8f051f4f0614a4e5498b4fe56b3cd74bff624208010ec1e42df7201afe91df95ec826c5481f6ef0e657ed5479 ChimeraInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC\Blob = 0300000001000000140000003f369fec1ea4b285a44f3ad935922b152d7c68ac2000000001000000640500003082056030820448a003020102020900b9a5e5882ca0467a300d06092a864886f70d01010505003081dc310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31393037060355040b1330687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083130363838343335301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019d30820199300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736673352d31362e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818d06082b06010505070101048180307e302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f305006082b060105050730028644687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73665f696e7465726d6564696174652e637274301f0603551d23041830168014494b5227d11bbcf2a1216a627b51427a8ad7d556301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d010105050003820101009b9545c0c75b4bc3e9cd82632781066973f7b0d6b9b054329f19518e75692963b629e8f8454199f3d28be28c718f7aba36fb534427d84945527d2843936433091b6d12c9792364ade245e20d1a4e18ae88f31cb210af70ab5af0718bc71417a062ef696ef77f350639220f7161ede483ae7b0038d282429768991d5479b7acb90c66d6c3631149755345436a2675934c21eef2d1014d8e6cc16fe9d775d28648a5a0fc7004d6abc9466f7a7b89fd94c8f1963596e7cdfc4520a3393a3e1381ccd128b2a480eb31cb1081864fb7cddca58d8bd2b8f051f4f0614a4e5498b4fe56b3cd74bff624208010ec1e42df7201afe91df95ec826c5481f6ef0e657ed5479 irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 Chimera tool crack.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5949AD9D9287F0B87ECA28A9066B100F15F3247B\Blob = 0f00000001000000200000005573a10dab6cf44399fd3923a024c851e0576fe290d9819cbfe2976873c859470300000001000000140000005949ad9d9287f0b87eca28a9066b100f15f3247b2000000001000000c2050000308205be308204a6a00302010202100b105d2c23912b465462986c40d5c52a300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3137303330393030303030305a170d3230303331323132303030305a3081da311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302534b311330110603550405130a33352039323420313935311a30180603550409131153706f72746f766120313236302f35312e310e300c060355041113053932393031310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311d301b060355040a13144575726f202d2053657276657220732e722e6f2e311d301b060355040313144575726f202d2053657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a028201010091b7603010f0a864f488401115b1f95d67761e347051ef179d5f5eed341be525a58119d0a8de120db469a9ab5e61ab17f877e697f55ea3f8b55fe849000f5d0fb1456a28284d1f3f53ee0342375268d0acb911fc7dd317342e51275d5089cf0b59f9d3a218c0469edf023eb0f30880fed37f8d832070a4099d1864995fb16a69b82ff93ee2b0f537da7c9a6055a9cdcc50bdc06528462280f264334fc3763633baae521f7cadd3edfa1b3ef124062b5a49930056ecd91f9791a4c95a5586c3c3638bfc6cccf13c284caf50b570e0c0ace7ee3457af31877cc18ced75ca8dd0da690155c63980c632324dc0e2f50066ccf21cfaec78e0bafc6417e5aef8b3cff90203010001a38201eb308201e7301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604141662ddf8462fcc5bf5ca9c50b3871183d07260a630280603551d110421301fa01d06082b06010505070803a011300f0c0d534b2d33352039323420313935300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101000eee22d5968d296cb7abd135b24cb9dab19fe5d279f53b20f89247249b251b9aedcc3cdde444c777685fe38e50925288d2f070f16544205a2f5d1932ae341301442980d4fd9fbe5b8dd0a5f88c6b9c9fc157eb40ef27e1e9f0b0753da3b453ec8bd631418b1125f681b5b3140521212255b421a6306d16bbfc31dcfa8d9bda1b71ac4d9d2c528ec9b6eb519dcc4bccb6b55b6665a9d96dab3577dde50777ffabf99e37ad6faf01fbee7354a2954aec76f87eea23bde6d774625a0265d27e4da16c94d4cd76f067baf5f9c1584ba1d8710eab775b9ca51a6e22e6b62a4c030f749df647d952f744fb483b3d2fd16e91a5f7a89bb3890a79d18b5e8acd0d6f18dd DrvInst.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC\Blob = 0300000001000000140000003f369fec1ea4b285a44f3ad935922b152d7c68ac2000000001000000640500003082056030820448a003020102020900b9a5e5882ca0467a300d06092a864886f70d01010505003081dc310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31393037060355040b1330687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083130363838343335301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019d30820199300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736673352d31362e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818d06082b06010505070101048180307e302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f305006082b060105050730028644687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73665f696e7465726d6564696174652e637274301f0603551d23041830168014494b5227d11bbcf2a1216a627b51427a8ad7d556301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d010105050003820101009b9545c0c75b4bc3e9cd82632781066973f7b0d6b9b054329f19518e75692963b629e8f8454199f3d28be28c718f7aba36fb534427d84945527d2843936433091b6d12c9792364ade245e20d1a4e18ae88f31cb210af70ab5af0718bc71417a062ef696ef77f350639220f7161ede483ae7b0038d282429768991d5479b7acb90c66d6c3631149755345436a2675934c21eef2d1014d8e6cc16fe9d775d28648a5a0fc7004d6abc9466f7a7b89fd94c8f1963596e7cdfc4520a3393a3e1381ccd128b2a480eb31cb1081864fb7cddca58d8bd2b8f051f4f0614a4e5498b4fe56b3cd74bff624208010ec1e42df7201afe91df95ec826c5481f6ef0e657ed5479 Chimera tool crack.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 Chimera tool crack.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC\Blob = 0300000001000000140000003f369fec1ea4b285a44f3ad935922b152d7c68ac2000000001000000640500003082056030820448a003020102020900b9a5e5882ca0467a300d06092a864886f70d01010505003081dc310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31393037060355040b1330687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083130363838343335301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019d30820199300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736673352d31362e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818d06082b06010505070101048180307e302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f305006082b060105050730028644687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73665f696e7465726d6564696174652e637274301f0603551d23041830168014494b5227d11bbcf2a1216a627b51427a8ad7d556301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d010105050003820101009b9545c0c75b4bc3e9cd82632781066973f7b0d6b9b054329f19518e75692963b629e8f8454199f3d28be28c718f7aba36fb534427d84945527d2843936433091b6d12c9792364ade245e20d1a4e18ae88f31cb210af70ab5af0718bc71417a062ef696ef77f350639220f7161ede483ae7b0038d282429768991d5479b7acb90c66d6c3631149755345436a2675934c21eef2d1014d8e6cc16fe9d775d28648a5a0fc7004d6abc9466f7a7b89fd94c8f1963596e7cdfc4520a3393a3e1381ccd128b2a480eb31cb1081864fb7cddca58d8bd2b8f051f4f0614a4e5498b4fe56b3cd74bff624208010ec1e42df7201afe91df95ec826c5481f6ef0e657ed5479 Chimera tool crack.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC\Blob = 0300000001000000140000003f369fec1ea4b285a44f3ad935922b152d7c68ac2000000001000000640500003082056030820448a003020102020900b9a5e5882ca0467a300d06092a864886f70d01010505003081dc310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31393037060355040b1330687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083130363838343335301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019d30820199300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736673352d31362e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818d06082b06010505070101048180307e302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f305006082b060105050730028644687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73665f696e7465726d6564696174652e637274301f0603551d23041830168014494b5227d11bbcf2a1216a627b51427a8ad7d556301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d010105050003820101009b9545c0c75b4bc3e9cd82632781066973f7b0d6b9b054329f19518e75692963b629e8f8454199f3d28be28c718f7aba36fb534427d84945527d2843936433091b6d12c9792364ade245e20d1a4e18ae88f31cb210af70ab5af0718bc71417a062ef696ef77f350639220f7161ede483ae7b0038d282429768991d5479b7acb90c66d6c3631149755345436a2675934c21eef2d1014d8e6cc16fe9d775d28648a5a0fc7004d6abc9466f7a7b89fd94c8f1963596e7cdfc4520a3393a3e1381ccd128b2a480eb31cb1081864fb7cddca58d8bd2b8f051f4f0614a4e5498b4fe56b3cd74bff624208010ec1e42df7201afe91df95ec826c5481f6ef0e657ed5479 Chimera tool crack.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 ChimeraInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 ChimeraInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\9CC2DFF107216AFEBD6DA2E09B1D7B4BDB35538C\Blob = 180000000100000010000000d5efbbba6dc194e45908382ca3a45eaf0300000001000000140000009cc2dff107216afebd6da2e09b1d7b4bdb35538c0400000001000000100000003382a7f518850cd567e88a8d739d112d190000000100000010000000c54ade6117de2b6e77d7983f5b115bbc1400000001000000140000009c66181bf14db34cc6eec861b0b840bc84ad19260f000000010000001400000058750f1ebee8f99b460526b0202673a9ab00b87e5c0000000100000004000000000800002000000001000000820500003082057e30820466a00302010202100b173f08a4013672fc0514bc261af232300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b446967694365727420455620436f6465205369676e696e67204341301e170d3230303231343030303030305a170d3233303232323132303030305a3081ae31133011060b2b0601040182373c0201031302534b311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311330110603550405130a33352039323420313935310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311d301b060355040a13144575726f202d2053657276657220732e722e6f2e311d301b060355040313144575726f202d2053657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a02820101009d717c73e1996f7bce4758a7de77b84ef563485a3706bbe43bdcbee9830613ddb56bfe7fef6fd96f55ccc581ec39842c6ce21bb430af31d541d7675db343bdefc9e45d35a98f4c7af019f2ee7d287f4f2976975d980a4ea79a150aa9b6f731b8dd0f3e4bb3fcfd04ed66f1b7b4f6c4f412899f498ec24dda4e8d30631d9216c2b14ba4ca0c8a567eac3b78480761763fb3f9ac123d64350f0fdc9c2dfd72589f30146989d021547aadeed542e948a676deefdbc5d1ec081008b4a0722a8ab9c7977ae7af3076c7b2363bc4431d3c0a8acce86f3c8c56644d116d38b72719359485a63ea344ae14c2b93ec30fd2f1e181225bcbe404aefa6653cc9d9707f86dc50203010001a38201de308201da301f0603551d23041830168014ad690670fc801b16b3a918946b9402865ef7278c301d0603551d0e041604149c66181bf14db34cc6eec861b0b840bc84ad192630280603551d110421301fa01d06082b06010505070803a011300f0c0d534b2d33352039323420313935300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010074e82329e63ce89e4e497aac1751feb916e76e3992f9b5f15617cffaa0490fbeb34f04ae41da9784bd088e4d206c266e50ca340ca14a258df68f8ed9ac1b1290ff8ee9277d2e417dffa688eea00b7eeb802ffb133535b3d7785183e4b40b761afe7803f0a0c5a9f876372ccadbabfa416ce2c72d8979916189bfca62fbe6b9a9004d4cc4f400c41adb296ea6993fd07d444cf667ccc4cc333fc80a6d3d14fe418260ce5e474e8cc5deffd61a3232fa8e103c6b16ee95692ad75e1ec7cd68fb1d6fc34bf6b4b56979ce8b5eb4e08f7e4be9081a18ecac5eca4d484775300583fd06e8b8316e3feabe01f2220e5f35350bfed7066190e95a17bb4e667fdb6b1d4c irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 0f0000000100000020000000d0ca9e3a95c6f217a238368e906972b00e8922eea264114b9fcb71ecbb563280030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 DrvInst.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 Chimera tool crack.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC\Blob = 0300000001000000140000003f369fec1ea4b285a44f3ad935922b152d7c68ac2000000001000000640500003082056030820448a003020102020900b9a5e5882ca0467a300d06092a864886f70d01010505003081dc310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31393037060355040b1330687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083130363838343335301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019d30820199300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736673352d31362e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818d06082b06010505070101048180307e302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f305006082b060105050730028644687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73665f696e7465726d6564696174652e637274301f0603551d23041830168014494b5227d11bbcf2a1216a627b51427a8ad7d556301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d010105050003820101009b9545c0c75b4bc3e9cd82632781066973f7b0d6b9b054329f19518e75692963b629e8f8454199f3d28be28c718f7aba36fb534427d84945527d2843936433091b6d12c9792364ade245e20d1a4e18ae88f31cb210af70ab5af0718bc71417a062ef696ef77f350639220f7161ede483ae7b0038d282429768991d5479b7acb90c66d6c3631149755345436a2675934c21eef2d1014d8e6cc16fe9d775d28648a5a0fc7004d6abc9466f7a7b89fd94c8f1963596e7cdfc4520a3393a3e1381ccd128b2a480eb31cb1081864fb7cddca58d8bd2b8f051f4f0614a4e5498b4fe56b3cd74bff624208010ec1e42df7201afe91df95ec826c5481f6ef0e657ed5479 ChimeraInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\314A7D9D02E5763D63B6C1D47FF2629B0FA49415\Blob = 180000000100000010000000307886a8cfb5aea7f013e2217b270a1c030000000100000014000000314a7d9d02e5763d63b6c1d47ff2629b0fa49415190000000100000010000000ea8b059daffad593d0a639feb5ea6aab040000000100000010000000a38a1b98eef7478fd88b0c77e7b8c5ca14000000010000001400000089fc943d8756c129d6f306f2bb68833aae94e71c0f00000001000000200000000445e941154cbb9ddff37f24f63220f6f2dcf9ad1647407b1c8c17f5c42b0b105c000000010000000400000000080000200000000100000096050000308205923082047aa003020102021001c946a9809859fd5d954411cc9f845b300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3230303231343030303030305a170d3233303431393132303030305a3081ae31133011060b2b0601040182373c0201031302534b311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311330110603550405130a33352039323420313935310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311d301b060355040a13144575726f202d2053657276657220732e722e6f2e311d301b060355040313144575726f202d2053657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100d5686b7c01e4ffcbc8f40de1560d61cfb9b84b65fc907b4e8cc6401030847f535a5648b0902aad2ccba9318daff6849a90f0c95f637d0eb45ef0ffd0253f5b6e9a5451c0610537acc2fd473d2905ab1fa02fa743d3d83b041d782d8c5f29191ebda74c76cf7855ffa67227adda5af517d04c8b9eb8be81f5c896eaec14f6ef1584ea6aebfb9e2f48ab944bd62287c22933b38b7a84cf3de7ef536f42580e2f6cff2f49cc210c4f69cd55e9947fb6883b2bc8b5fa008ff741c3a541d305a5ec5afc4111f90a881fca6d65cf67145bfa0b5cc1757de301d06393090b87a028d00509bdc47a0947465a21327e85031b985b382a573de3b45505a92db11a46e6bb010203010001a38201eb308201e7301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e0416041489fc943d8756c129d6f306f2bb68833aae94e71c30280603551d110421301fa01d06082b06010505070803a011300f0c0d534b2d33352039323420313935300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010033b39ba0bece53ca0c5ec3b77dcc12acd0ea63220404b009f874495fe55597278f8dc611339dbdf207796fe7f58d83940a1554b46acf630fbd73b9c520bcfdabb04339d7a5793510fc65e3b28f801ca57841daeac76f21a90d9a20d956d442c2bc217518dd40c369d42fce804f95d9cdca8252b0605a6dbf60fb604a940a536cc68d204489a427a3d97c16030fe305ba108c19cbb6a126149d333abd7c82b7a44c2db7f47810fc20ee7c1f4cf2ec9e208023d5894346ecaaecbb7cc0dde41869f00f4cb3b09fe9f726feb2151f5d7a5e19d9a8498d4977715dd97abf7a3cc5a7fff53d3a18d432a7c1dc96360bd20382227a93162745ade3f92dbf1e69e29099 irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5949AD9D9287F0B87ECA28A9066B100F15F3247B\Blob = 0300000001000000140000005949ad9d9287f0b87eca28a9066b100f15f3247b2000000001000000c2050000308205be308204a6a00302010202100b105d2c23912b465462986c40d5c52a300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3137303330393030303030305a170d3230303331323132303030305a3081da311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302534b311330110603550405130a33352039323420313935311a30180603550409131153706f72746f766120313236302f35312e310e300c060355041113053932393031310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311d301b060355040a13144575726f202d2053657276657220732e722e6f2e311d301b060355040313144575726f202d2053657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a028201010091b7603010f0a864f488401115b1f95d67761e347051ef179d5f5eed341be525a58119d0a8de120db469a9ab5e61ab17f877e697f55ea3f8b55fe849000f5d0fb1456a28284d1f3f53ee0342375268d0acb911fc7dd317342e51275d5089cf0b59f9d3a218c0469edf023eb0f30880fed37f8d832070a4099d1864995fb16a69b82ff93ee2b0f537da7c9a6055a9cdcc50bdc06528462280f264334fc3763633baae521f7cadd3edfa1b3ef124062b5a49930056ecd91f9791a4c95a5586c3c3638bfc6cccf13c284caf50b570e0c0ace7ee3457af31877cc18ced75ca8dd0da690155c63980c632324dc0e2f50066ccf21cfaec78e0bafc6417e5aef8b3cff90203010001a38201eb308201e7301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604141662ddf8462fcc5bf5ca9c50b3871183d07260a630280603551d110421301fa01d06082b06010505070803a011300f0c0d534b2d33352039323420313935300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101000eee22d5968d296cb7abd135b24cb9dab19fe5d279f53b20f89247249b251b9aedcc3cdde444c777685fe38e50925288d2f070f16544205a2f5d1932ae341301442980d4fd9fbe5b8dd0a5f88c6b9c9fc157eb40ef27e1e9f0b0753da3b453ec8bd631418b1125f681b5b3140521212255b421a6306d16bbfc31dcfa8d9bda1b71ac4d9d2c528ec9b6eb519dcc4bccb6b55b6665a9d96dab3577dde50777ffabf99e37ad6faf01fbee7354a2954aec76f87eea23bde6d774625a0265d27e4da16c94d4cd76f067baf5f9c1584ba1d8710eab775b9ca51a6e22e6b62a4c030f749df647d952f744fb483b3d2fd16e91a5f7a89bb3890a79d18b5e8acd0d6f18dd irsetup.exe - Checks BIOS information in registry 2 TTPs 5 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ChimeraInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ChimeraInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Chimera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Chimera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Chimera.exe - Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation 51be9b727f591b18573d40b6fe913a90c5341bfb.exe Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation irsetup.exe Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation Chimera.exe Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation chimera_browser.exe Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation chimera_browser.exe Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation ChimeraInstaller.exe - Executes dropped EXE 15 IoCs
pid Process 468 ChimeraInstaller.exe 4608 ChimeraInstaller.exe 876 51be9b727f591b18573d40b6fe913a90c5341bfb.exe 5376 irsetup.exe 8140 dpinst64.exe 5552 dpinst64.exe 3620 dpinst64.exe 6148 Chimera tool crack.exe 9192 Chimera tool crack.exe 5288 Chimera.exe 8576 Chimera tool crack.exe 516 chimera_browser.exe 8156 chimera_browser.exe 5220 chimera_browser.exe 1360 chimera_browser.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Wine Chimera.exe - Loads dropped DLL 18 IoCs
pid Process 5376 irsetup.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 516 chimera_browser.exe 516 chimera_browser.exe 8156 chimera_browser.exe 8156 chimera_browser.exe 5220 chimera_browser.exe 5220 chimera_browser.exe 1360 chimera_browser.exe 1360 chimera_browser.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Chimera.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ChimeraInstaller.exe - Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Chimera.exe File opened for modification \??\PhysicalDrive0 ChimeraInstaller.exe - Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\android_winusb.inf_amd64_5ce397a79c9d056c\android_winusb.PNF dpinst64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\amd64\SET7801.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\SET7803.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\androidwinusba64.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\amd64\SET7773.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\amd64\SET7801.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\SET7803.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\android_winusb.inf_amd64_5ce397a79c9d056c\amd64\WdfCoInstaller01009.dll DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\amd64\WdfCoInstaller01009.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\amd64\WinUSBCoInstaller2.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\SET7802.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\android_winusb.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\android_winusb.inf_amd64_5ce397a79c9d056c\androidwinusba64.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\amd64 DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt dpinst64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\amd64\SET7773.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ff5a3706-bbec-5c40-bddd-b3919ff99679}\SET7802.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\android_winusb.inf_amd64_5ce397a79c9d056c\amd64\WinUSBCoInstaller2.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\android_winusb.inf_amd64_5ce397a79c9d056c\android_winusb.inf DrvInst.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 38 IoCs
pid Process 4608 ChimeraInstaller.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe -
resource yara_rule behavioral1/files/0x00070000000243e1-12.dat upx behavioral1/memory/468-14-0x0000000000400000-0x0000000001F0A000-memory.dmp upx behavioral1/memory/468-4164-0x0000000000400000-0x0000000001F0A000-memory.dmp upx behavioral1/files/0x000400000001da34-4184.dat upx behavioral1/memory/5376-4193-0x0000000000C10000-0x0000000000FFA000-memory.dmp upx behavioral1/memory/5376-4244-0x0000000000C10000-0x0000000000FFA000-memory.dmp upx behavioral1/memory/5376-4364-0x0000000000C10000-0x0000000000FFA000-memory.dmp upx behavioral1/files/0x00070000000243e0-4384.dat upx behavioral1/memory/6148-4386-0x0000000000400000-0x0000000001EF7000-memory.dmp upx behavioral1/memory/6148-8514-0x0000000000400000-0x0000000001EF7000-memory.dmp upx behavioral1/memory/6148-8518-0x0000000000400000-0x0000000001EF7000-memory.dmp upx - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN Chimera.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Chimera\Drivers\51be9b727f591b18573d40b6fe913a90c5341bfb.exe ChimeraInstaller.exe File created C:\Program Files (x86)\Chimera\libEGL.dll Chimera.exe File opened for modification C:\Program Files (x86)\Chimera\libEGL.dll Chimera.exe File created C:\Program Files (x86)\Chimera\libGLESv2.dll Chimera.exe File opened for modification C:\Program Files (x86)\Chimera\DataFiles\database.db Chimera.exe File opened for modification C:\Program Files (x86)\Chimera\DataFiles\database.db-wal Chimera.exe File opened for modification C:\Program Files (x86)\Chimera\DataFiles\database.db-shm Chimera.exe File opened for modification C:\Program Files (x86)\Chimera\Chimera.exe ChimeraInstaller.exe File created C:\Program Files (x86)\Chimera\uninstall.exe ChimeraInstaller.exe File opened for modification C:\Program Files (x86)\Chimera\uninstall.exe ChimeraInstaller.exe File opened for modification C:\Program Files (x86)\Chimera\libGLESv2.dll Chimera.exe File created C:\Program Files (x86)\Chimera\dic32u.dll Chimera.exe File opened for modification C:\Program Files (x86)\Chimera\dic32u.dll Chimera.exe File opened for modification C:\Program Files (x86)\Chimera\DataFiles\database.db-journal Chimera.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\DPINST.LOG dpinst64.exe File opened for modification C:\Windows\DPINST.LOG dpinst64.exe File opened for modification C:\Windows\INF\setupapi.dev.log dpinst64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\DPINST.LOG dpinst64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1316 CMD.exe 5132 CMD.exe - System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ChimeraInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ChimeraInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chimera_browser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chimera tool crack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chimera_browser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language irsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chimera tool crack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chimera tool crack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chimera_browser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51be9b727f591b18573d40b6fe913a90c5341bfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chimera_browser.exe - Checks SCSI registry key(s) 3 TTPs 59 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation Chimera.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Chimera.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Address Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs dpinst64.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Chimera.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom dpinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver Chimera.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID dpinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags Chimera.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dpinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025 Chimera.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs dpinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Chimera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID Chimera.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dpinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID dpinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe - Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330780613916527" Chimera.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry Chimera.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe - Modifies system certificate store 2 TTPs 30 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC\Blob = 0300000001000000140000003f369fec1ea4b285a44f3ad935922b152d7c68ac2000000001000000640500003082056030820448a003020102020900b9a5e5882ca0467a300d06092a864886f70d01010505003081dc310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31393037060355040b1330687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083130363838343335301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019d30820199300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736673352d31362e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818d06082b06010505070101048180307e302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f305006082b060105050730028644687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73665f696e7465726d6564696174652e637274301f0603551d23041830168014494b5227d11bbcf2a1216a627b51427a8ad7d556301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d010105050003820101009b9545c0c75b4bc3e9cd82632781066973f7b0d6b9b054329f19518e75692963b629e8f8454199f3d28be28c718f7aba36fb534427d84945527d2843936433091b6d12c9792364ade245e20d1a4e18ae88f31cb210af70ab5af0718bc71417a062ef696ef77f350639220f7161ede483ae7b0038d282429768991d5479b7acb90c66d6c3631149755345436a2675934c21eef2d1014d8e6cc16fe9d775d28648a5a0fc7004d6abc9466f7a7b89fd94c8f1963596e7cdfc4520a3393a3e1381ccd128b2a480eb31cb1081864fb7cddca58d8bd2b8f051f4f0614a4e5498b4fe56b3cd74bff624208010ec1e42df7201afe91df95ec826c5481f6ef0e657ed5479 irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\9CC2DFF107216AFEBD6DA2E09B1D7B4BDB35538C\Blob = 180000000100000010000000d5efbbba6dc194e45908382ca3a45eaf0300000001000000140000009cc2dff107216afebd6da2e09b1d7b4bdb35538c0400000001000000100000003382a7f518850cd567e88a8d739d112d190000000100000010000000c54ade6117de2b6e77d7983f5b115bbc1400000001000000140000009c66181bf14db34cc6eec861b0b840bc84ad19260f000000010000001400000058750f1ebee8f99b460526b0202673a9ab00b87e5c0000000100000004000000000800002000000001000000820500003082057e30820466a00302010202100b173f08a4013672fc0514bc261af232300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b446967694365727420455620436f6465205369676e696e67204341301e170d3230303231343030303030305a170d3233303232323132303030305a3081ae31133011060b2b0601040182373c0201031302534b311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311330110603550405130a33352039323420313935310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311d301b060355040a13144575726f202d2053657276657220732e722e6f2e311d301b060355040313144575726f202d2053657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a02820101009d717c73e1996f7bce4758a7de77b84ef563485a3706bbe43bdcbee9830613ddb56bfe7fef6fd96f55ccc581ec39842c6ce21bb430af31d541d7675db343bdefc9e45d35a98f4c7af019f2ee7d287f4f2976975d980a4ea79a150aa9b6f731b8dd0f3e4bb3fcfd04ed66f1b7b4f6c4f412899f498ec24dda4e8d30631d9216c2b14ba4ca0c8a567eac3b78480761763fb3f9ac123d64350f0fdc9c2dfd72589f30146989d021547aadeed542e948a676deefdbc5d1ec081008b4a0722a8ab9c7977ae7af3076c7b2363bc4431d3c0a8acce86f3c8c56644d116d38b72719359485a63ea344ae14c2b93ec30fd2f1e181225bcbe404aefa6653cc9d9707f86dc50203010001a38201de308201da301f0603551d23041830168014ad690670fc801b16b3a918946b9402865ef7278c301d0603551d0e041604149c66181bf14db34cc6eec861b0b840bc84ad192630280603551d110421301fa01d06082b06010505070803a011300f0c0d534b2d33352039323420313935300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010074e82329e63ce89e4e497aac1751feb916e76e3992f9b5f15617cffaa0490fbeb34f04ae41da9784bd088e4d206c266e50ca340ca14a258df68f8ed9ac1b1290ff8ee9277d2e417dffa688eea00b7eeb802ffb133535b3d7785183e4b40b761afe7803f0a0c5a9f876372ccadbabfa416ce2c72d8979916189bfca62fbe6b9a9004d4cc4f400c41adb296ea6993fd07d444cf667ccc4cc333fc80a6d3d14fe418260ce5e474e8cc5deffd61a3232fa8e103c6b16ee95692ad75e1ec7cd68fb1d6fc34bf6b4b56979ce8b5eb4e08f7e4be9081a18ecac5eca4d484775300583fd06e8b8316e3feabe01f2220e5f35350bfed7066190e95a17bb4e667fdb6b1d4c irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 Chimera tool crack.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC Chimera tool crack.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7 Chimera tool crack.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC ChimeraInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\314A7D9D02E5763D63B6C1D47FF2629B0FA49415\Blob = 180000000100000010000000307886a8cfb5aea7f013e2217b270a1c030000000100000014000000314a7d9d02e5763d63b6c1d47ff2629b0fa49415190000000100000010000000ea8b059daffad593d0a639feb5ea6aab040000000100000010000000a38a1b98eef7478fd88b0c77e7b8c5ca14000000010000001400000089fc943d8756c129d6f306f2bb68833aae94e71c0f00000001000000200000000445e941154cbb9ddff37f24f63220f6f2dcf9ad1647407b1c8c17f5c42b0b105c000000010000000400000000080000200000000100000096050000308205923082047aa003020102021001c946a9809859fd5d954411cc9f845b300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3230303231343030303030305a170d3233303431393132303030305a3081ae31133011060b2b0601040182373c0201031302534b311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311330110603550405130a33352039323420313935310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311d301b060355040a13144575726f202d2053657276657220732e722e6f2e311d301b060355040313144575726f202d2053657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100d5686b7c01e4ffcbc8f40de1560d61cfb9b84b65fc907b4e8cc6401030847f535a5648b0902aad2ccba9318daff6849a90f0c95f637d0eb45ef0ffd0253f5b6e9a5451c0610537acc2fd473d2905ab1fa02fa743d3d83b041d782d8c5f29191ebda74c76cf7855ffa67227adda5af517d04c8b9eb8be81f5c896eaec14f6ef1584ea6aebfb9e2f48ab944bd62287c22933b38b7a84cf3de7ef536f42580e2f6cff2f49cc210c4f69cd55e9947fb6883b2bc8b5fa008ff741c3a541d305a5ec5afc4111f90a881fca6d65cf67145bfa0b5cc1757de301d06393090b87a028d00509bdc47a0947465a21327e85031b985b382a573de3b45505a92db11a46e6bb010203010001a38201eb308201e7301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e0416041489fc943d8756c129d6f306f2bb68833aae94e71c30280603551d110421301fa01d06082b06010505070803a011300f0c0d534b2d33352039323420313935300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010033b39ba0bece53ca0c5ec3b77dcc12acd0ea63220404b009f874495fe55597278f8dc611339dbdf207796fe7f58d83940a1554b46acf630fbd73b9c520bcfdabb04339d7a5793510fc65e3b28f801ca57841daeac76f21a90d9a20d956d442c2bc217518dd40c369d42fce804f95d9cdca8252b0605a6dbf60fb604a940a536cc68d204489a427a3d97c16030fe305ba108c19cbb6a126149d333abd7c82b7a44c2db7f47810fc20ee7c1f4cf2ec9e208023d5894346ecaaecbb7cc0dde41869f00f4cb3b09fe9f726feb2151f5d7a5e19d9a8498d4977715dd97abf7a3cc5a7fff53d3a18d432a7c1dc96360bd20382227a93162745ade3f92dbf1e69e29099 irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC\Blob = 0300000001000000140000003f369fec1ea4b285a44f3ad935922b152d7c68ac2000000001000000640500003082056030820448a003020102020900b9a5e5882ca0467a300d06092a864886f70d01010505003081dc310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31393037060355040b1330687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083130363838343335301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019d30820199300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736673352d31362e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818d06082b06010505070101048180307e302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f305006082b060105050730028644687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73665f696e7465726d6564696174652e637274301f0603551d23041830168014494b5227d11bbcf2a1216a627b51427a8ad7d556301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d010105050003820101009b9545c0c75b4bc3e9cd82632781066973f7b0d6b9b054329f19518e75692963b629e8f8454199f3d28be28c718f7aba36fb534427d84945527d2843936433091b6d12c9792364ade245e20d1a4e18ae88f31cb210af70ab5af0718bc71417a062ef696ef77f350639220f7161ede483ae7b0038d282429768991d5479b7acb90c66d6c3631149755345436a2675934c21eef2d1014d8e6cc16fe9d775d28648a5a0fc7004d6abc9466f7a7b89fd94c8f1963596e7cdfc4520a3393a3e1381ccd128b2a480eb31cb1081864fb7cddca58d8bd2b8f051f4f0614a4e5498b4fe56b3cd74bff624208010ec1e42df7201afe91df95ec826c5481f6ef0e657ed5479 Chimera tool crack.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC\Blob = 0300000001000000140000003f369fec1ea4b285a44f3ad935922b152d7c68ac2000000001000000640500003082056030820448a003020102020900b9a5e5882ca0467a300d06092a864886f70d01010505003081dc310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31393037060355040b1330687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083130363838343335301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019d30820199300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736673352d31362e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818d06082b06010505070101048180307e302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f305006082b060105050730028644687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73665f696e7465726d6564696174652e637274301f0603551d23041830168014494b5227d11bbcf2a1216a627b51427a8ad7d556301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d010105050003820101009b9545c0c75b4bc3e9cd82632781066973f7b0d6b9b054329f19518e75692963b629e8f8454199f3d28be28c718f7aba36fb534427d84945527d2843936433091b6d12c9792364ade245e20d1a4e18ae88f31cb210af70ab5af0718bc71417a062ef696ef77f350639220f7161ede483ae7b0038d282429768991d5479b7acb90c66d6c3631149755345436a2675934c21eef2d1014d8e6cc16fe9d775d28648a5a0fc7004d6abc9466f7a7b89fd94c8f1963596e7cdfc4520a3393a3e1381ccd128b2a480eb31cb1081864fb7cddca58d8bd2b8f051f4f0614a4e5498b4fe56b3cd74bff624208010ec1e42df7201afe91df95ec826c5481f6ef0e657ed5479 Chimera tool crack.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC\Blob = 0300000001000000140000003f369fec1ea4b285a44f3ad935922b152d7c68ac2000000001000000640500003082056030820448a003020102020900b9a5e5882ca0467a300d06092a864886f70d01010505003081dc310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31393037060355040b1330687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083130363838343335301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019d30820199300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736673352d31362e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818d06082b06010505070101048180307e302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f305006082b060105050730028644687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73665f696e7465726d6564696174652e637274301f0603551d23041830168014494b5227d11bbcf2a1216a627b51427a8ad7d556301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d010105050003820101009b9545c0c75b4bc3e9cd82632781066973f7b0d6b9b054329f19518e75692963b629e8f8454199f3d28be28c718f7aba36fb534427d84945527d2843936433091b6d12c9792364ade245e20d1a4e18ae88f31cb210af70ab5af0718bc71417a062ef696ef77f350639220f7161ede483ae7b0038d282429768991d5479b7acb90c66d6c3631149755345436a2675934c21eef2d1014d8e6cc16fe9d775d28648a5a0fc7004d6abc9466f7a7b89fd94c8f1963596e7cdfc4520a3393a3e1381ccd128b2a480eb31cb1081864fb7cddca58d8bd2b8f051f4f0614a4e5498b4fe56b3cd74bff624208010ec1e42df7201afe91df95ec826c5481f6ef0e657ed5479 ChimeraInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 ChimeraInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7 Chimera tool crack.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 Chimera tool crack.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC\Blob = 0300000001000000140000003f369fec1ea4b285a44f3ad935922b152d7c68ac2000000001000000640500003082056030820448a003020102020900b9a5e5882ca0467a300d06092a864886f70d01010505003081dc310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31393037060355040b1330687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083130363838343335301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019d30820199300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736673352d31362e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818d06082b06010505070101048180307e302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f305006082b060105050730028644687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73665f696e7465726d6564696174652e637274301f0603551d23041830168014494b5227d11bbcf2a1216a627b51427a8ad7d556301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d010105050003820101009b9545c0c75b4bc3e9cd82632781066973f7b0d6b9b054329f19518e75692963b629e8f8454199f3d28be28c718f7aba36fb534427d84945527d2843936433091b6d12c9792364ade245e20d1a4e18ae88f31cb210af70ab5af0718bc71417a062ef696ef77f350639220f7161ede483ae7b0038d282429768991d5479b7acb90c66d6c3631149755345436a2675934c21eef2d1014d8e6cc16fe9d775d28648a5a0fc7004d6abc9466f7a7b89fd94c8f1963596e7cdfc4520a3393a3e1381ccd128b2a480eb31cb1081864fb7cddca58d8bd2b8f051f4f0614a4e5498b4fe56b3cd74bff624208010ec1e42df7201afe91df95ec826c5481f6ef0e657ed5479 ChimeraInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\9CC2DFF107216AFEBD6DA2E09B1D7B4BDB35538C irsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC Chimera tool crack.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC\Blob = 0300000001000000140000003f369fec1ea4b285a44f3ad935922b152d7c68ac2000000001000000640500003082056030820448a003020102020900b9a5e5882ca0467a300d06092a864886f70d01010505003081dc310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31393037060355040b1330687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083130363838343335301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019d30820199300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736673352d31362e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818d06082b06010505070101048180307e302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f305006082b060105050730028644687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73665f696e7465726d6564696174652e637274301f0603551d23041830168014494b5227d11bbcf2a1216a627b51427a8ad7d556301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d010105050003820101009b9545c0c75b4bc3e9cd82632781066973f7b0d6b9b054329f19518e75692963b629e8f8454199f3d28be28c718f7aba36fb534427d84945527d2843936433091b6d12c9792364ade245e20d1a4e18ae88f31cb210af70ab5af0718bc71417a062ef696ef77f350639220f7161ede483ae7b0038d282429768991d5479b7acb90c66d6c3631149755345436a2675934c21eef2d1014d8e6cc16fe9d775d28648a5a0fc7004d6abc9466f7a7b89fd94c8f1963596e7cdfc4520a3393a3e1381ccd128b2a480eb31cb1081864fb7cddca58d8bd2b8f051f4f0614a4e5498b4fe56b3cd74bff624208010ec1e42df7201afe91df95ec826c5481f6ef0e657ed5479 Chimera tool crack.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 Chimera tool crack.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC Chimera tool crack.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7 Chimera tool crack.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7 irsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\314A7D9D02E5763D63B6C1D47FF2629B0FA49415 irsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC irsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5949AD9D9287F0B87ECA28A9066B100F15F3247B irsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7 ChimeraInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7 ChimeraInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5949AD9D9287F0B87ECA28A9066B100F15F3247B\Blob = 0300000001000000140000005949ad9d9287f0b87eca28a9066b100f15f3247b2000000001000000c2050000308205be308204a6a00302010202100b105d2c23912b465462986c40d5c52a300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3137303330393030303030305a170d3230303331323132303030305a3081da311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302534b311330110603550405130a33352039323420313935311a30180603550409131153706f72746f766120313236302f35312e310e300c060355041113053932393031310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311d301b060355040a13144575726f202d2053657276657220732e722e6f2e311d301b060355040313144575726f202d2053657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a028201010091b7603010f0a864f488401115b1f95d67761e347051ef179d5f5eed341be525a58119d0a8de120db469a9ab5e61ab17f877e697f55ea3f8b55fe849000f5d0fb1456a28284d1f3f53ee0342375268d0acb911fc7dd317342e51275d5089cf0b59f9d3a218c0469edf023eb0f30880fed37f8d832070a4099d1864995fb16a69b82ff93ee2b0f537da7c9a6055a9cdcc50bdc06528462280f264334fc3763633baae521f7cadd3edfa1b3ef124062b5a49930056ecd91f9791a4c95a5586c3c3638bfc6cccf13c284caf50b570e0c0ace7ee3457af31877cc18ced75ca8dd0da690155c63980c632324dc0e2f50066ccf21cfaec78e0bafc6417e5aef8b3cff90203010001a38201eb308201e7301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604141662ddf8462fcc5bf5ca9c50b3871183d07260a630280603551d110421301fa01d06082b06010505070803a011300f0c0d534b2d33352039323420313935300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101000eee22d5968d296cb7abd135b24cb9dab19fe5d279f53b20f89247249b251b9aedcc3cdde444c777685fe38e50925288d2f070f16544205a2f5d1932ae341301442980d4fd9fbe5b8dd0a5f88c6b9c9fc157eb40ef27e1e9f0b0753da3b453ec8bd631418b1125f681b5b3140521212255b421a6306d16bbfc31dcfa8d9bda1b71ac4d9d2c528ec9b6eb519dcc4bccb6b55b6665a9d96dab3577dde50777ffabf99e37ad6faf01fbee7354a2954aec76f87eea23bde6d774625a0265d27e4da16c94d4cd76f067baf5f9c1584ba1d8710eab775b9ca51a6e22e6b62a4c030f749df647d952f744fb483b3d2fd16e91a5f7a89bb3890a79d18b5e8acd0d6f18dd irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A7E3A467024FFA1DCE74842C491E6BBAAE6123C7\Blob = 030000000100000014000000a7e3a467024ffa1dce74842c491e6bbaae6123c72000000001000000440500003082054030820428a00302010202084907c25d92d984ef300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3135313230343038303033385a170d3138303932383138323534325a3061310b300906035504061302534b311830160603550407130f44756e616a736b6120537472656461311b3019060355040a13124575726f2d53657276657220732e722e6f2e311b3019060355040313124575726f2d53657276657220732e722e6f2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100daf719b5b3530bb03d6bb53cacd4fe8b573f94035a796e2c2faa27ea7dfa8e3cdfe843fb596524f9a153a4c8e6c0745f213674312132944b135c2fc53bcc6801692427fa4925089884f24970170f0cc85c824cf31b953e46ceb7d910684337fd0bce11e58bf527b815ab2463cdd9012612de483ca679b33ca41b0d985f5ed7a7871931af6cae28b53696903fd8cd6ac32a50213ec192fdfb127ee873c7482478626cc9025089de21a60396492fe871765b58e5265bb09158ae7cdb9c493420145db92e53f26275b62602c0b8b94c8148a6a97b30fa68b2d0e865d9c80e69d0db63efdb9413705216c17d8e661aecaf121778115db709839a4102334880d36fc10203010001a382019430820190300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff040403020780303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e737461726669656c64746563682e636f6d2f736669673273352d302e63726c30590603551d2004523050304e060b6086480186fd6e01071702303f303d06082b060105050702011631687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f30818206082b0601050507010104763074302a06082b06010505073001861e687474703a2f2f6f6373702e737461726669656c64746563682e636f6d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db36663301d0603551d0e04160414ede79531901b916a183a6da721aeb6c10e0965ff300d06092a864886f70d01010b05000382010100173d1e411d7a14af3bbd8e45193f03f8120bea70bc00006cf270e468fe0f24777ba3ff27a60740a2d804cc7901baf8bfe20e98ff9deb77da2fe286c63ab3acd1eb3e01cac5d83c83e4e4b978b7001c2d5f7417bf12d24c28b4ed48a0d1a65cd624968a7fe3b85775c3df3fd859de59f5638691439224bcf58d1ff8f817383280800b96ac466281bb6993decb1ae857981a63ce90958d30b296da4392ae64aa964e11cb03cb4c37650db70bfe5e5be2f689cd93685439e33e08363830b06fd39933388e0eb397165322a2bd11c2af29ad46b209229ef9ebe777965e18953c733ab655af856c43ce080755dbaf1ff92929629ff620e7232fc5e4b2bcc4748a7f13 ChimeraInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F369FEC1EA4B285A44F3AD935922B152D7C68AC ChimeraInstaller.exe - Suspicious behavior: AddClipboardFormatListener 6 IoCs
pid Process 468 ChimeraInstaller.exe 4608 ChimeraInstaller.exe 6148 Chimera tool crack.exe 9192 Chimera tool crack.exe 5288 Chimera.exe 8576 Chimera tool crack.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 468 ChimeraInstaller.exe 468 ChimeraInstaller.exe 4608 ChimeraInstaller.exe 4608 ChimeraInstaller.exe 9192 Chimera tool crack.exe 9192 Chimera tool crack.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 516 chimera_browser.exe 516 chimera_browser.exe 8156 chimera_browser.exe 8156 chimera_browser.exe 5220 chimera_browser.exe 5220 chimera_browser.exe 1360 chimera_browser.exe 1360 chimera_browser.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe 5288 Chimera.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4608 ChimeraInstaller.exe 5288 Chimera.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2360 7zG.exe Token: 35 2360 7zG.exe Token: SeSecurityPrivilege 2360 7zG.exe Token: SeSecurityPrivilege 2360 7zG.exe Token: SeBackupPrivilege 7516 vssvc.exe Token: SeRestorePrivilege 7516 vssvc.exe Token: SeAuditPrivilege 7516 vssvc.exe Token: SeAuditPrivilege 3904 svchost.exe Token: SeSecurityPrivilege 3904 svchost.exe Token: SeBackupPrivilege 8052 srtasks.exe Token: SeRestorePrivilege 8052 srtasks.exe Token: SeSecurityPrivilege 8052 srtasks.exe Token: SeTakeOwnershipPrivilege 8052 srtasks.exe Token: SeBackupPrivilege 8052 srtasks.exe Token: SeRestorePrivilege 8052 srtasks.exe Token: SeSecurityPrivilege 8052 srtasks.exe Token: SeTakeOwnershipPrivilege 8052 srtasks.exe Token: 33 5288 Chimera.exe Token: SeIncBasePriorityPrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe Token: SeCreatePagefilePrivilege 5288 Chimera.exe Token: SeShutdownPrivilege 5288 Chimera.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2360 7zG.exe 5288 Chimera.exe 8576 Chimera tool crack.exe - Suspicious use of SetWindowsHookEx 29 IoCs
pid Process 468 ChimeraInstaller.exe 468 ChimeraInstaller.exe 468 ChimeraInstaller.exe 468 ChimeraInstaller.exe 4608 ChimeraInstaller.exe 876 51be9b727f591b18573d40b6fe913a90c5341bfb.exe 5376 irsetup.exe 5376 irsetup.exe 5376 irsetup.exe 8140 dpinst64.exe 5552 dpinst64.exe 3620 dpinst64.exe 6148 Chimera tool crack.exe 6148 Chimera tool crack.exe 6148 Chimera tool crack.exe 6148 Chimera tool crack.exe 9192 Chimera tool crack.exe 9192 Chimera tool crack.exe 9192 Chimera tool crack.exe 9192 Chimera tool crack.exe 5288 Chimera.exe 8576 Chimera tool crack.exe 8576 Chimera tool crack.exe 8576 Chimera tool crack.exe 8576 Chimera tool crack.exe 516 chimera_browser.exe 8156 chimera_browser.exe 5220 chimera_browser.exe 1360 chimera_browser.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 468 wrote to memory of 4608 468 ChimeraInstaller.exe 105 PID 4608 wrote to memory of 876 4608 ChimeraInstaller.exe 107 PID 876 wrote to memory of 5376 876 51be9b727f591b18573d40b6fe913a90c5341bfb.exe 108 PID 5376 wrote to memory of 8140 5376 irsetup.exe 117 PID 5376 wrote to memory of 5552 5376 irsetup.exe 118 PID 5376 wrote to memory of 1316 5376 irsetup.exe 119 PID 1316 wrote to memory of 4348 1316 CMD.exe 121 PID 5376 wrote to memory of 3620 5376 irsetup.exe 122 PID 3904 wrote to memory of 3044 3904 svchost.exe 124 PID 5376 wrote to memory of 5132 5376 irsetup.exe 125 PID 5288 wrote to memory of 516 5288 Chimera.exe 144 PID 5288 wrote to memory of 8156 5288 Chimera.exe 145 PID 5288 wrote to memory of 5220 5288 Chimera.exe 146 PID 5288 wrote to memory of 1360 5288 Chimera.exe 147 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Chimera_tool.zip1⤵PID:4012
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2748
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Chimera_tool\" -spe -an -ai#7zMap14265:104:7zEvent29491⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2360
-
C:\Users\Admin\AppData\Local\Temp\Chimera_tool\ChimeraInstaller.exe"C:\Users\Admin\AppData\Local\Temp\Chimera_tool\ChimeraInstaller.exe"1⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\Chimera_tool\ChimeraInstaller.exeC:/Users/Admin/AppData/Local/Temp/Chimera_tool/ChimeraInstaller.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Manipulates Digital Signatures
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Program Files (x86)\Chimera\Drivers\51be9b727f591b18573d40b6fe913a90c5341bfb.exe"C:\Program Files (x86)\Chimera\Drivers\51be9b727f591b18573d40b6fe913a90c5341bfb.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1683890 "__IRAFN:C:\Program Files (x86)\Chimera\Drivers\51be9b727f591b18573d40b6fe913a90c5341bfb.exe" "__IRCT:2" "__IRTSS:0" "__IRSID:S-1-5-21-1788976790-1541110888-1636651838-1000"4⤵
- Manipulates Digital Signatures
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\WIN10\android_winusb.inf"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:8140
-
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /SW /D /U "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\WIN7\android_winusb.inf"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:5552
-
-
C:\Windows\SysWOW64\CMD.exeCMD.exe /D /A /C FIND /i /c "androidusb.sys" C:\Windows\inf\*oem* > C:\Users\Admin\AppData\Local\Temp\DriverCheck.acd5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\find.exeFIND /i /c "androidusb.sys" C:\Windows\inf\*oem*6⤵
- System Location Discovery: System Language Discovery
PID:4348
-
-
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe" /PATH "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\WIN10" /SW /F /SA /SE /LM5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:3620
-
-
C:\Windows\SysWOW64\CMD.exeCMD.exe /D /A /C RMDIR C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0 /S /Q5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5132
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:7516
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:8052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c14ea12e-1da1-8343-9f69-cb296aac36cd}\android_winusb.inf" "9" "4e0faf5eb" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "c:\users\admin\appdata\local\temp\_ir_sf_temp_0\win10"2⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\Chimera_tool\Chimera tool crack.exe"C:\Users\Admin\AppData\Local\Temp\Chimera_tool\Chimera tool crack.exe"1⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6148
-
C:\Users\Admin\AppData\Local\Temp\Chimera_tool\Chimera tool crack.exe"C:\Users\Admin\AppData\Local\Temp\Chimera_tool\Chimera tool crack.exe"1⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:9192
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Chimera_tool\Read Me.txt1⤵PID:5752
-
C:\Program Files (x86)\Chimera\Chimera.exe"C:\Program Files (x86)\Chimera\Chimera.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Xen via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Looks for Xen service registry key.
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\ProgramData\Chimera\chimera_browser.exe"C:\ProgramData\Chimera\chimera_browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --locales-dir-path="C:\ProgramData\Chimera\locales" --log-severity=disable --resources-dir-path="C:\ProgramData\Chimera" --user-agent=Chimera_Browser --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --in-process-gpu --disable-speech-api --disable-component-update --disable-notifications --disable-breakpad --disable-background-networking --disable-translate --disable-extensions --disable-print-preview --disable-plugins --disable-features=blinkgenpropertytrees,translateui,translate,site-per-process --windows-job-name=CefView-Job-{f0a3c1e3-ff89-4581-8a45-f0bfd74c4bb0}-5288 --bridge-obj-name=ChimeraQCefInterop --log-file="C:\Program Files (x86)\Chimera\debug.log" --mojo-platform-channel-handle=3784 --field-trial-handle=3788,i,14690500012582962331,18123911332510912119,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:516
-
-
C:\ProgramData\Chimera\chimera_browser.exe"C:\ProgramData\Chimera\chimera_browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --locales-dir-path="C:\ProgramData\Chimera\locales" --log-severity=disable --resources-dir-path="C:\ProgramData\Chimera" --user-agent=Chimera_Browser --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --in-process-gpu --disable-speech-api --disable-component-update --disable-notifications --disable-breakpad --disable-background-networking --disable-translate --disable-extensions --disable-print-preview --disable-plugins --disable-features=blinkgenpropertytrees,translateui,translate,site-per-process --windows-job-name=CefView-Job-{f0a3c1e3-ff89-4581-8a45-f0bfd74c4bb0}-5288 --bridge-obj-name=ChimeraQCefInterop --log-file="C:\Program Files (x86)\Chimera\debug.log" --mojo-platform-channel-handle=3912 --field-trial-handle=3788,i,14690500012582962331,18123911332510912119,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:8156
-
-
C:\ProgramData\Chimera\chimera_browser.exe"C:\ProgramData\Chimera\chimera_browser.exe" --type=renderer --locales-dir-path="C:\ProgramData\Chimera\locales" --log-severity=disable --resources-dir-path="C:\ProgramData\Chimera" --user-agent=Chimera_Browser --disable-extensions --disable-print-preview --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --in-process-gpu --disable-speech-api --disable-component-update --disable-notifications --disable-breakpad --disable-background-networking --disable-translate --disable-extensions --disable-print-preview --disable-plugins --disable-features=blinkgenpropertytrees,translateui,translate,site-per-process --windows-job-name=CefView-Job-{f0a3c1e3-ff89-4581-8a45-f0bfd74c4bb0}-5288 --bridge-obj-name=ChimeraQCefInterop --first-renderer-process --no-sandbox --disable-breakpad --disable-notifications --disable-speech-api --log-file="C:\Program Files (x86)\Chimera\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4016 --field-trial-handle=3788,i,14690500012582962331,18123911332510912119,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5220
-
-
C:\ProgramData\Chimera\chimera_browser.exe"C:\ProgramData\Chimera\chimera_browser.exe" --type=renderer --locales-dir-path="C:\ProgramData\Chimera\locales" --log-severity=disable --resources-dir-path="C:\ProgramData\Chimera" --user-agent=Chimera_Browser --disable-extensions --disable-print-preview --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --in-process-gpu --disable-speech-api --disable-component-update --disable-notifications --disable-breakpad --disable-background-networking --disable-translate --disable-extensions --disable-print-preview --disable-plugins --disable-features=blinkgenpropertytrees,translateui,translate,site-per-process --windows-job-name=CefView-Job-{f0a3c1e3-ff89-4581-8a45-f0bfd74c4bb0}-5288 --bridge-obj-name=ChimeraQCefInterop --no-sandbox --disable-breakpad --disable-notifications --disable-speech-api --log-file="C:\Program Files (x86)\Chimera\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4048 --field-trial-handle=3788,i,14690500012582962331,18123911332510912119,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\Chimera_tool\Chimera tool crack.exe"C:\Users\Admin\AppData\Local\Temp\Chimera_tool\Chimera tool crack.exe"1⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:8576
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Virtualization/Sandbox Evasion
8Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Chimera\Drivers\51be9b727f591b18573d40b6fe913a90c5341bfb.exe
- Size 18.7MB
- SHA256 2e5e3d4e2e34bd8390f8b374991143fba2a867a990913fd2db04aaf86652c7b8
- MD5 ee719b8bdde0b606fb381ff29872c02a
- SHA1 5b9bd92ebce2c0900905ca7012349cd5437ea814
- SHA512 bad689bcba4184bc2b2c9323a686a53cb3f038ec75dfbdd540f244c2bb1b94ae290eef930b4e6311d1c1abded49128c3cba5458705738afdb851d84eebd19905
- SSDEEP 393216:VhJ7jQQ/CwnThEjkXslDAQOEXB0cKL/CwnThEjkXslDAQOEoB0cKW:VhxQICy1EgCAQ3XBUCy1EgCAQ3oBP
- TLSH T19A1733CBF32201F0D1EA52B4A3390226AB39490D837DA1EB7BE53E6CDD515C5B477289
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Chimera\dic32u.dll
- Size 116KB
- SHA256 97c8fc2188c4e124ea73e2fcce0908ecfa46938ed0289b2d822d41c69e990e07
- MD5 6690158d86b6199bdc2230edf00ab6b6
- SHA1 0439976733d85468d35ec3916b8c95b5f42cf7e1
- SHA512 23aa38cab96ecc53f9f332e770d218722d1a3ecd0f7e69fc454cf74bf9e34e979b7900b2823a705a02967646ff87508b0c0855decf612e428aabd9465ef83c46
- SSDEEP 1536:+Zdi+MbWdCKjjNhsNEP3wi2N2pKCwYhvkdc9IDq/xArGkutxLzLDE2P:8dl4KjnhoUpKCwcyqKrGDtxvE2
- TLSH T184C3AF0178D2C873E58A453D00A68B505B7F782B372595E7FBE82D8A1D702D0AB7B35B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\F0945DEB9235B550DD90E53ADA3D127DCC123D1930732041496D01FDD5979994.zip
- Size 488KB
- SHA256 f0945deb9235b550dd90e53ada3d127dcc123d1930732041496d01fdd5979994
- MD5 678216ad11612a2fb5a5a8fa42d9ef13
- SHA1 080ac177921b7acf25343b9a29e483e9c7c9f2ef
- SHA512 654aa06e34b36839c37f1330b225d739dae3dbff34d6e29181c14c1645fcaf5dbe1c487dc219d5874f26575ebd3875deafdc466de62619ed326eeb22d8bd2dd3
- SSDEEP 12288:MDN1brB2MJQYdRDNSxCuJxFrTgXAABhCukntmJpL9:SrcMWyRRSx1xq1BiMJpZ
- TLSH T1CBB423ED6168D1079E617A07CF2C92B2077EC37B99836802F53B840955E07A42B7DF6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\cache\Code Cache\js\index-dir\the-real-index
- Size 120B
- SHA256 c0715e431dbb1d7b1b36fd96f4b7158ae3916fb6a3c598604cfbe02ca5f60396
- MD5 228dc5f7eeadfc93c2b510f912312d71
- SHA1 9d6c260c6af2205ad0d888b5dd8c6643f3567cd8
- SHA512 f3807bc0e06de65c9852369706f873bad107c851b189e6edb12af34d1904c54e7cfa9e6ffce448001fca17151c76b7e949b1ecff208f34f3d9e67cbb5aba1251
- TLSH T125B012F0CCC61086EF2182742AC9D8813132047EC312077340F1D0FC43025D67209448
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Chimera\cache\Code Cache\js\index-dir\the-real-index~RFe5d8b1c.TMP
- Size 48B
- SHA256 39c4f996f3fe4c88321e61ac52e8c569fe9f0f5a0913df6b47de7fbf1e9a768d
- MD5 7dd6c7244ccbf6c5bce34e5544a09570
- SHA1 81cdf57de304ecb35f96c9e880bbd27a03763245
- SHA512 c49739677fd57355e197569d5a3b1a756019ef3a5725126fef7df7de11e10e72f8db104c4e0a1dd851eeab2092f28e1a60a08852aa5b08e30c2ba962e60d997b
- MD5 SHA1 SHA512
- Path C:\ProgramData\Chimera\cache\Network\Network Persistent State
- Size 1KB
- SHA256 d332d5b2bfd7b2628114b7a63c997d66cbb113f58066d274aacf0c525ef4638e
- MD5 7601b00702d082a3b0a7e604d48bbc9b
- SHA1 668834982dce6498135d9a0d55fa350620475e72
- SHA512 de95d78fdb2cb8dd4efad0e37ec72954c31415b59e1ac100f72180cd60bf25351f05dbdc8869965aa7bba81f8622071e711bb5b4f1cd9a40c55d30ef4fae209d
- TLSH T19621BBE7C7E849BE495252F12B253E23C8AE0928232C3C43C8D8DF4E97F5875920058F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Chimera\cache\Network\Network Persistent State~RFe5e4c78.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Chimera\cache\Session Storage\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\ProgramData\Chimera\chimera_browser.exe
- Size 1.6MB
- SHA256 0a99465f04b9dd89ce07d7a7da663aaf097a0008145781d7e6d650978025679b
- MD5 18663600c2761dde88bacf40793b65dc
- SHA1 30e3a5ba618e979bcdd3c6fdd9100a0e21d5897f
- SHA512 937d75ccc31fb2dc4e924d06054397640ba7601234582f559ddbb31e029c1ee4b0942b218cc62ff58e9009069efc35abc3c6c4c3f0db7989bd188f21ac0fde77
- SSDEEP 49152:KX5JzWktxhGdkZLLaCmQJiLjy1ZJ7GcHmNrJJXN3OHYg:65s593wYg
- TLSH T19C757C223A81C471D312347A02BFF6394BBEEE214B1459C387953D2AEB317D16E36979
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\chrome_100_percent.pak
- Size 607KB
- SHA256 80139849d4cf4a9dc8ad429be071229bd7538c41f5af5aed498fd981873bd4cf
- MD5 eae66715d9a0d3a3574223e130dd3c83
- SHA1 8c6d664f736414c9fa75a5eaff2b452a94875a4c
- SHA512 f7e9a41030452879612a2916c06d514290757d2ba44149973deb45021622520bbe05a338d7d1554e095a48812ded0ee47f40c73ae7b1b988edadda7ef717f3fc
- SSDEEP 12288:dN8I3HbGgsz5B0GDJQrnKs8SNP+QSsSilHjzaR+6IdRuEDoO0Tehf7:r370zEEmPLScjz16oRZoO0TOj
- TLSH T1EDD412D373B4ED3DEA67567BA22904B4EC7345190AA2020A178FE8796E53748D8DD3C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\chrome_200_percent.pak
- Size 915KB
- SHA256 f2a2c9dd0ec8baf6820b445a1485787c6651d3f0c8d0ec8f58a808b836fa04d0
- MD5 7f25dc4230fbfb1b2ee7a2133f929fe4
- SHA1 54b9c0240f18f7f1507ade53cf332b63926a9077
- SHA512 c8a4cb67ebccf4e5e721e9542a5b4f94db1bd30ddd090f784db5d02b84a22c07aec013c51a5a8e045ca1cb8065d0917313eb39dac39032216091e675f65eb39e
- SSDEEP 24576:d3K0zkmmibkFR8+mZ8svQtPUw9WNbaK6edhOLoJ9:d3K0YmNbkFRJm2wQtJ9WTjrO6
- TLSH T1D71512D3A374CD7DCD630A77A25A01F1FCB510360AB6550B07ABAD393A567889CCA783
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\chrome_elf.dll
- Size 1.1MB
- SHA256 c8beee9950b3925471ff89084c27eca7254b62a28299f1757d59e585c67bc20c
- MD5 7fccbd9168945fdb1e1327d9dd737716
- SHA1 10b16e9cf22c13382a906e598004ae0eb534040f
- SHA512 6d78968b9ecc019d6638e031e827629bb2be25f9a006cbb4e18b226d7a51fc74f7ca72c465e951da702634588c15afa2bad1dddb3f5ad225ba77c9e3d1993f38
- SSDEEP 24576:7/RXMusl1Rug4ueDLBFvC3nweuwf2n0YW:LxslLug4ueDLBFvCAj0B
- TLSH T15D35AF02B494D072D8123136712CE7392B39AE114B248EC7D795FDEA6FB45C2563E3AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\d3dcompiler_47.dll
- Size 3.9MB
- SHA256 c2c7ca6505ad10826e6b92319ce7aa355392b0cbd092a0fb8d4381c2d31268bf
- MD5 e1677ec0e21e27405e65e31419980348
- SHA1 666de481c46e2c21b8f0decc7e9115fc61d28acd
- SHA512 31ea9e22a2de873ad71c56386b45f510cc89b63eff5526f75a9de7987c65e91bff9ae141cb47b49b986992a53d9a6e73fa3199a04f0bde665d4928112fd13070
- SSDEEP 98304:q4Xyn7IfxiYMzgom1mEU/AJC/vujMD9rw:809om1hU/Aavu4D9rw
- TLSH T11B169E26F6428072D8CB05F066AE7766943C9F345B3445C79290ADA9FC702D32F3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\icudtl.dat
- Size 10.1MB
- SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
- MD5 2134e5dbc46fb1c46eac0fe1af710ec3
- SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
- SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb
- SSDEEP 98304:GKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8j:GKPBhORjOhCliXUxiG9Ha93Whla6ZGr4
- TLSH T1C4B63803A2FB4EC2F9FB6F31D8F452679567BD496E32805A01042F3B5C336908665BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\libEGL.dll
- Size 366KB
- SHA256 cce43fe8973b5f8b90e08b013f1eb0fa015090ff088f59a096d49a1b5e7a3540
- MD5 624f09454239f2ff043191a0e6606b56
- SHA1 d4bbcb68546cf5e908a9029d078d0a3d8316c436
- SHA512 c3c2e9d7240b2ddc6808c3cd6eca2783f10537030764061f33dc078b588947982865c0fd6494f4a156873cf4c68b2ae4894ebdde777112294017cd03a6284e32
- SSDEEP 6144:TrIyxDkGuf/lN8/UEuIAzPeMQ5HdHiL3PKvCyrlZX:fhGGuo/UEuIAzPe9m3ivRf
- TLSH T179848E01B540D471C8BE20753A28D36D5F7DB9605B7948CBA39C0EBEAFF06C24A3576A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\libGLESv2.dll
- Size 6.1MB
- SHA256 bf6647fbe37dfe836ecceabb5ea53f5aa3aeb0375a8c7aef06e06fcbfcb3b1b1
- MD5 5b01726435c8c09cc2b4c94ced8ae5ea
- SHA1 7e69c8ccf1e61f6e944ccb2c9657e11de0eb6f33
- SHA512 5465d7f21a78433976d18bed10c9b7987b5eefcd49869c3412e517a8d88c610ffdf2b064d1fdac612cebd7245c15a4620de5bc751c602640a37a3dfc1a95ada0
- SSDEEP 196608:kLydnm0rAbG93rWJX9eJrFd/gRXSCHtt8cL:9c0rAbQrWJX9eJrFd/gRXjt2cL
- TLSH T149569C01A5806135DC5E61327E1FAB2AAF34A3654B618EC7E9482DB43FF40E3537626F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\libcef.lib
- Size 39KB
- SHA256 e9c55cff925e26812139cdcad6612e0d69e317cb7bb1435c9eb5113d338acce7
- MD5 310744a0e10bd9c2c6f50c525e4447f9
- SHA1 9ba62d6ac2cb8eff46c9b21051677fc1dc66d718
- SHA512 6df9e3f9afd7cdec750b006987e5aec445e163dd0b9cf1a9ea53f78db2ee5fd654e3b4f82bca3e1f4bedb189f5dfa51189c820905676ad048dbe2e0ad405bf5b
- SSDEEP 384:EDDktao110LafOv9YObvWKH0Nd4wM5gqJ/xqFeRinM68BifLUsOgC7EYo:gDkP10LafOR5gmqFSinF8BsYo
- TLSH T18303F66118188C7EFBFC2C779A3D9299034D998A9A124967768F41E6CBFFC11C733609
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\af.pak
- Size 416KB
- SHA256 4fb9dfed9ac2e6dd68c35bec83041f66ddfc8e5aa4f1eee9dae5aa00df5942b1
- MD5 0aad7bcaa4ddb662c2b6808207d4b7f6
- SHA1 ce13aad904715ba77438805120f76bb01be11ce4
- SHA512 c600a2e2fc313dda5823b54ab5c804dce8aa3d9be3ee4f73100a5b18f5e2d096a177eecb94cd758f17d595e7544ed82c41f7ac8dfab031886c338e8895851d49
- SSDEEP 12288:t23uU8/NrfBgREzo+PnUTfjA636Zi2Jyn9YbgMpgHq5mGSt2+8Yj35CBte6whiG7:oed/xJgREzo+PUjjA636Zi2Jyn9YbgMs
- TLSH T1FA942D0AEB84273D09A07696FA0445F7BF9CA26CD770B2B6DD9D823605A6EFC017D1C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\am.pak
- Size 674KB
- SHA256 757fc53ecb4f5d913d9de0acc06d4bfdd73f36d5aad68fd657f9a612b4dbce13
- MD5 4f3605c5d424543599d079d07c6cacba
- SHA1 948690a2efc848ab8c47da85bc5a435d316243c0
- SHA512 137eab3e1ec042e498972ffda98527c8e98dc5b709cbba25f438c440103f13b45f9a764a439e65626cedb2cbc1bd3061690b9bfa966dd1e0b675a90a8047dd9a
- SSDEEP 12288:T/kbxT9TuK3m8xSTwnF/vQgfzqiF5R9/6VqduvyPRx30jH8+Q:T/iT9Nm8xLnFnQgfzqiF5R9/6Vq8yP1
- TLSH T180E4B9547EF9F7570F8E8A19A4310E4E9594AD4692803C38D35AD3FC2B2EF1B4DDA218
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\ar.pak
- Size 743KB
- SHA256 6258ea73b1476f90ba7441cc096322a3e1145e17c475b3351581e464df47cb17
- MD5 9c7895a26bcab397e696164b418e5b05
- SHA1 ce8df21fc1a06f6a19dbc843903f9ea79bbb4ac2
- SHA512 a24edb6ee28552b27be203aed179744954d77369814e6b50306d6a51046790fa3ed19247d9ec578e5ae311889aa2bd4943cb5ce870aea0b5cbd3c3e5dea3d90b
- SSDEEP 12288:I6OAKCrPtqtbNpX8vYU0GrbfkHAs5kNiV+UTzecKMgSEN8P:z0JM0L5L+s
- TLSH T1A6F48AE21B2984720B96DF0FD1E23668D872BD23DB4BFC3124934A2156D7513E78E678
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\bg.pak
- Size 769KB
- SHA256 ebcf4c4be2cd84d22830541f3112c5f3475938a460cb4605ab20095c8e0e6587
- MD5 9c591deee522ad82e1fcbceada85969e
- SHA1 b72ddefb099e3c11136f12dd45b50f18aa2b26fa
- SHA512 68f251bb18e1e4791509f2a14ed6cba95dc79872bbbd65cda9ebfbf700172718db9a5dcd8d24db1ac8089ea18c72beca39a5641dd01cc7eb2de74d044c193251
- SSDEEP 24576:oZ9w2qfPQlYMdAs1aQUUy/835uK4iVD1DoTIu6p5a5I+35QTqu0RlVQb5N/6c6yz:oZ9w2qfPQlYEUUyk356iVD1DoTQa5I+y
- TLSH T14EF423A15B9A64DF0101F55F98087E093CEB84FE3FE7879241642DBD39F20B486BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\bn.pak
- Size 992KB
- SHA256 5c191e0d941c19e732b7b2a1410ebfd9d88f7bf352316dcce1536213c9a86a17
- MD5 30261f13cbbfe7074cb5ea10b63af9b5
- SHA1 382665999aeea0e89370b5a746a8bdf24ede586e
- SHA512 1823a9d421079b3000e89963073a52f5334725f7c2829b33d92a0951fa4e6913d4b3a7dfdd69118e7c66b3b6c3259069c4ec0c88cd5d7142fcd2d2a31e24ddc1
- SSDEEP 3072:YddwfRcexJf/dgfLLJC/aq8Hf20FtCLaYCkGBbd3IDb5190Xltk+Z:fiTLjCuY2BbdO5Ale+Z
- TLSH T1D525EF209C6E91B2A8C5CDC9434C6370C523AE979B61F74DDC17A24938ADC7C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\ca.pak
- Size 476KB
- SHA256 cea499b26690805b28628eb4b1a3146cdbe4425eddfddb1a231b203e2676a87f
- MD5 0461073f8b210034563aa7ea49e16244
- SHA1 2987741bed6a870be2fd95b796d122eb032d4168
- SHA512 3ed5f15ddd5934ac6457fb995f06b04f0c7a7f6d0df5aed79cc3a06454fddc715c48da26999873ec9620fce0f82c5efea9177dcdbdcb855f30d50f747a158bbe
- SSDEEP 12288:wvw4qn14gG5PAF4N3Mw2juwwY8orHRjIs3cSlFEYLCJwBB3nbhjJOtsrwiwWlMwZ:wo4ItzRPRWfuMNo8RHHx56vIo
- TLSH T169A40A239FC93B6744D2220AFB46C217B48CA9847B06D254F5AF1B1623CCADCC677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\cs.pak
- Size 483KB
- SHA256 61c96ca87d0ad3db0435cbe23f0552de86f50488ac91b373dda4b9bf0d08f088
- MD5 698b0d757da753cc6de5b8469bdff59e
- SHA1 282e243b018f919072c9cc63ada10ebeb07051bb
- SHA512 5f649959dfebd023ec19ad1ab0da90ca5c53f010af03ceaed2bf23c5da0e32aab1f1ed2fbf5836880b12f6af10307ac4fcf13908e7cd470ca99010e6e965ea1e
- SSDEEP 6144:Hxb83Vcg7Cr7SQzYBAxQhpF5v8VTDKND+Gt/d8Qws3:CVxCvSQ8ZhpF5v8VTGNDhL
- TLSH T1C7B44B1EEFA36425488002497BBE4228BD5E83540B6FB5AB7C8F9D81217577ECEF4D48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\da.pak
- Size 439KB
- SHA256 fcf728644873cd91c4d4617036679945626be34cc01ed93eb34818e2d422311b
- MD5 a6785bfbbbf01c548fe73288c83410ea
- SHA1 4f13a37395e8e949a76ea1c02dcacabde8ebffc5
- SHA512 9612e3d43ca218c78aee1a7f309063b9f1e29bbd5404f42c5bd3f41c2f4c8dde92448f7d680ea239ddcaf244a2e2e295bc0d537b8bd4a8ca3af3376d6808efd2
- SSDEEP 6144:B7/qhFcZEii27t5cf6Tim0wlG72JwcnKEbuQnvDHG5YSr4bzOti6hd4CTWwtzzZv:BTeug2bTPpKBr5nrZTb
- TLSH T1F9A44A4BDC5C732F89A94B65F2108EA7EB5D543CC680224F75C8953E0ACFD6096BE2C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\de.pak
- Size 475KB
- SHA256 991f3ad76ea4659a12e920d5c4300dbc4221d3ca665216f94a1b393657170c81
- MD5 e962099280156e07bd108b9b77855e79
- SHA1 8be173544abe2b9d78641f8f8aab4a0aa5a1489a
- SHA512 a19e4d3661a8c138a1ccdddec696764df3e7e7119fc84a444e9e259832a7db2865d4a1687d5890f8d7c9b0547542e3a501cdb737970d101148d5d8e02f4f3471
- SSDEEP 6144:Gx91SQcsAsE53K7UpMwUBgaoa5UzUlcEaC34HEmhkYF5rRmNbOI1RCBE:Gx91Rm53K7UpeBgPaoBHEW5S9XCBE
- TLSH T127A40603ADDF621FC782B3607305CDB77B18E2AFC346312694EDD12B614B5B282AD566
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\el.pak
- Size 843KB
- SHA256 ef4cfd37c7fa18f2f6d70a9f1e41bc85e783ac3d25d357904cb7c338993800f7
- MD5 7abe7cd2feae3143925c03e3b9d0d9e8
- SHA1 154828b99bdd437778b67a62099ad31c1ba05c47
- SHA512 bcdfc047374cea58a1874c1ad923c55e3c54ff2bd324541a4c57285454cad72d156a1d9b16b298fa1e66e0aae706189c495b5bf06bc0418dd85bb7c4cdf00c37
- SSDEEP 24576:uTkquK5cMaH52202ppFs3jy7dJoaEA3HViE0BR07391Qf23tKMaBlSEXnx6bW1rm:IkquK5cMaHA202ppFs3jy7dJoaEA3HVF
- TLSH T1FC05BFEFB4582DED8085950785D8F07C6BC62D6CE749CBD86229CB60BDF90718A22D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\en-GB.pak
- Size 380KB
- SHA256 d7b75984f0ab3531d4313428eb60f3db8aaa68ed746f1fccfe8c50f6a33cd6eb
- MD5 3ebd952852f6f509b0165bc61fd1354f
- SHA1 58b32088398650828874ea7f748e20e84ddd52cd
- SHA512 8c517e8f73257fa0edb43be45f5e3781fd59798935d5619840426ea0ca5e7ce806234bed5782a05ab0380be03ba38f76dd37c6436c37aca02961ab8f93f2f3af
- SSDEEP 6144:EX0mRV2MDKxkMP9egEXwvfaYIQX6/5EBSyBxiKT:unG6MUXw6Qy5+SQT
- TLSH T149843C1FF784122A069311727B0AA662FF26D07CB35112663CAD816C33B7B56C2777E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\en-US.pak
- Size 384KB
- SHA256 18b68d00be426a4f7acd4efc1e45ae296720ade13ca66d3cf768e48d814b6a25
- MD5 6252747a75950f7b35dfab8a68b5a2e2
- SHA1 9e326b2e19369da8dd964179b5cb6e281200c459
- SHA512 d5ce8114e5d25ae0dd6fcaafc760e5e07f16679b9d34783bbeb7cc43f7e1b91c61d9322991893f39de799c332d497c0d787ee64c064cab4b4eab907e9953d140
- SSDEEP 6144:Gsa9U2QMh961PILMP9ecNmMJfaY2zt9j5urSgne2aVwG:Gsa9U1DV2MlmMKzn58S3VwG
- TLSH T116846D1FF744222A069352627F099562BF36D06CA35112663CBD813C33B7B66C27B7E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\es-419.pak
- Size 465KB
- SHA256 f77575044a56dbbb4028313df0871914e1c5edc018b54335ece31c7a9c2b25e9
- MD5 0bcd531dfc75388e9fcadd021848a79e
- SHA1 df1f5a627d664f1fddff54795df9e72b22ffdde4
- SHA512 371fc85fd2ef91e442e97ffde1c31f46340a048b48e92457cfd50cb2882862257cb54b6b1aff2f9ad829fb9ac802fed44aae03348740153aedb3aa923ce855a3
- SSDEEP 6144:Nc79v0zo83XHMyuQjeqYphpRUC5MLF8lookQjmvw:Nqv0rZWp6C56F/ouw
- TLSH T1F3A41A22BAC81F5310E2A389B783D753E5989545F408C29BE8EB876512DCF8CC877ED5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\es.pak
- Size 464KB
- SHA256 e3e9f85180b65b1574a47fa22b2f2d30fc0afb59199464af0064874487a7c1d0
- MD5 c8fcb66a978998b9578dc0435f9c6dc0
- SHA1 f9f7b90a326a0f4e3239b9670dbe4b5ce4309fdc
- SHA512 2190e9c9fcec3ae875752723380dab57ad8688794be2f2fc71dc9ff626268ac517f7d1da4e01a862cdf6b47fa6b33a95735537f5456ed9f05dfe0a234e8fbac4
- SSDEEP 6144:/PdPbIcOcwSQ1jrdclZXM+9vzgAClpn3Dnvhjap5vrS7OqoceB5r6PZik8jW:Xq0gjpwd7up3Dnpjap5vrEocEdW
- TLSH T13EA41922BACC1B6340D39385B743D753E8989595B408C29BE8EF876612CCBCCC967ED5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\et.pak
- Size 421KB
- SHA256 e2502464e4b05373adb129ca24cd1b04363ab58ee9f074d58eba3daec2fe3763
- MD5 cab8391198071ecf164854d917bf563a
- SHA1 50df35cd030791573c5130335280f45233956bdb
- SHA512 15d7b15b1257e3a95cd3511d6d28b5f82b674872f2a10a92404efd908fcbabaa00cce87044c1dc3154815b6065b5740443e28c309fe738b51198e28ef20952c5
- SSDEEP 6144:2HNL1EixVl+fx22xsN0Hy0rC4ItJbT/Ryw6iINg5zjx43BaLwltPQGC:2H11EYQxk/j2g5zjD
- TLSH T114943B42617D771B582451F9A337AD23CC9EE7D8B4000DA2BC964A1971FEF8C3876B68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\fa.pak
- Size 686KB
- SHA256 71e0cbfcb334fe6830517e0131caca602ad31f4b853dfab55d852844987139fe
- MD5 9c986e1b4a10b41747dbb41a0caaaf72
- SHA1 ab4149b51d8f4427187b32db93dca1b7e9990bd3
- SHA512 4b021c1a81ccdaf34286ea3fcf0257722a128af0bc4bcbeb7be790b2cf0c7a7e626d960e1b785480ab347a1b1a9632e63723cf889365fbd64e0097629e0c5cc9
- SSDEEP 12288:ecFam2nX9nAGaHzOT4imdAQifaQ2XxFvGqNOtqoRQuFBnrhidpxHsAQi6FgfwHZY:eYam2JAGaHzOT4imdAQifaQ2XxFvGqNd
- TLSH T1CEE4C3957AAC5AB16756CA0341E33834C773EF12D34DFE40ACA1076609A5B139F4EA3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\fi.pak
- Size 428KB
- SHA256 35f28344c4758eae428d322d6f72dff32fab7be51cf2e4fac990e894e690a0ad
- MD5 5ab307a3fb735e6a37814efc8abd495b
- SHA1 ce06113bed731555d23a9fabf680e8295120092b
- SHA512 c9e5137177d63d86a796d76a930b443c32416af0eb8fdace4dae8f52e39eef1dbd4e040abc52be91931704418e501b893d7192e87695a0d2e3a9d9aefdd68f4e
- SSDEEP 6144:P58hgpOrGWRqyohFA42sXSiOE/72a8NoLX5rYucHsE418OWUcv+VBPGNC/X1wWI:agGQRVaal5rYxHsE418OWU6CI
- TLSH T121946E915219C22137C4C29E79B0903EF6D9E3DCCC28889AE847C7D949EE9C87D7176E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\fil.pak
- Size 483KB
- SHA256 6e831fec12173421aa1ee390927c6322c604c57d0f6dd848cb98cfc6b13f7310
- MD5 79b399b94fa2068e26adba332b7048e8
- SHA1 f83b199217b4902ebdf9a6d0dc128060eeff1319
- SHA512 5dc1047d316ef765a67ef42ecebf689bf9d6a00a6c4eff444eab7d958e2ffd6eeeae47d83bd48bed791860e9395dacfd7d974071705cc79310f32e1c51df2125
- SSDEEP 6144:GOCOGF46azJVyEDQVayS/0iUn0FeMhG8Z3wmA5ZXmVbVAT5vyj:PCJrDk3UyXA5tml
- TLSH T123B4B505B7402748DBC356E513A0682F66E530B83F827C6E4FBF269B6BA7CD5D270186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\fr.pak
- Size 505KB
- SHA256 3de246f60f1ff3801edc4a5c8e12a7219bb97d90afdb8595673db09bed1261b6
- MD5 cb6942ba75762e6948528ac17f91cc6f
- SHA1 5a3f81a8b39187b7660936a4b9518ebbe0a688f5
- SHA512 52b5f98674324407ca9f6c016bb523d7a10464e312ea4f1a65d074f74f776b9852deec8efd45a77dd4fe64e5536898294e08927c392f0cdb8bc7ad4ca306ec74
- SSDEEP 12288:d1S4DY3NAIb6QuagV1dzrPrhZUMYnYMArDBGuKY5hxTq20wC9TZL3qXLk1oThuKa:d1S4RVO9O587
- TLSH T1BCB4D55FB9D4328B19C21277FB12D663DD348248F216E340D89F4299129A8ECD39F6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\gu.pak
- Size 973KB
- SHA256 fd3cf66a25e7651debffbe9ee7b748f29a937460fe559179bbfd502085177ae8
- MD5 dd46c06a0cf2bea35f6632e82de0279d
- SHA1 8f327015e6299f323bef3102b0f928cd226ed9c3
- SHA512 d89132e77e6f46f9ffe24ee0717f98c8804e710bff28af2497f2371dabebf829d82b3c329f48bb001f80df45962d2a8e8a6ee3d7e0a5cb51bf99ae2c60c034ea
- SSDEEP 3072:Em2J1lUH9fMwvezJ6JZyLRy/GQoyLEivijZwmJSgSJNmUBOjdBjFGTtVa6QJe5BQ:tW1LtaZyAyfbpsh5rOh4fWmO
- TLSH T1FA2509D0D3B9F07119DA9F7E819E512086695343D57E230051CEEE898801DEF3EEEA9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\he.pak
- Size 603KB
- SHA256 4d15cb1054eb3274503a35300914823e0c23f3f0c2c384ffd671a87d98a09753
- MD5 9c7171a339765e139f46a6cd6124d4d0
- SHA1 d59850c68ecb235711f61560c579d3114981eee8
- SHA512 badaba0ed8db3221b0c7077606bc1d2cbde125ad4c284e236194584854c2c05666d3e0b1fb54507f84f254abc26c2f85350ab1dc474ed56f8c13631ec52f0a29
- SSDEEP 12288:S9YWUO9xszQmRryOUmTU2/9EiiBH60/AffX4neQCapeF5vgHodwMzj5SlmdXDnw1:gq54oW
- TLSH T139D489C4B2D452255231AAC39FA8FA286FF3CAB53CA27512CB14526CAC774F4BD530B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\hi.pak
- Size 1.0MB
- SHA256 766ffabc715a7ee131aa2ab4419ed7814af63a356c0119a0b13743a4e77db389
- MD5 d7bdb2d07a32347d20d9ab4969e9afbe
- SHA1 22a15db737a9db5ab3da4a89f338fc329533ca29
- SHA512 a3b91ee3c8946840726f0485ec34a2dfd5df13a017d571793ff4084d6519d5dd2f91da24dbe6826ac5f114e70c44673fdbabd9e9e48605ffbbf9b8b1f3122fa9
- SSDEEP 3072:rQzMXCC2v1acSvYav9S4yFkjeOTByntDPtDlqpX/M5rw3kw376ccDdTSb9VjgFS3:rg51ac6o4sO5+5iJ8hQ
- TLSH T18B25060CEBBEF3B55DEC3C9A32890D37D59D3674A3E9521348D5B3DB9844CB4046A2A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\hr.pak
- Size 467KB
- SHA256 eb4562e2e6fbdb037e1678c1c2fab359c288fbb8bfd692c2d5525ca5baea7c45
- MD5 488946588f5a601b538d9e55c6b8a3f2
- SHA1 9750060733036d5ef4fb64942e2559dd3b5bb248
- SHA512 f2db5363b07f262f08050daf55f9a08fd9a5cd7bca3851dd3f4763f010e69a24c951bec48283b4795b03eae9701dc061359ad89e40be6f06b58e28368a8233eb
- SSDEEP 3072:2oHptO/TynPvEH3jAzy+wZprPRTKOOS+7ItocIG0uPXVyAF6Wk6DkYAiKbeM/ogM:2oH+uPvq36wjxiaWt5517uwm0+
- TLSH T10FA42A7CBEB3970A0896A346EFA643447DBD08DCE56587BB784F532E0043F4D6AB8149
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\hu.pak
- Size 502KB
- SHA256 2eb64bd39b09fcfb1ccd6a6297a6446319379a29de1254d2311e8bb5f846a46e
- MD5 4100709da9ac4ee5f2d3728b8943e517
- SHA1 bc54493b79b13e9b61d459041786443a9faa63ae
- SHA512 214ca26a587eddf5ccf04ffe085181944662740a2789bb4aec0b41dbab2a788f300324b7f7b9ab6ae7de67dadf7cbeb82dd92ae1498d14d8b6506186a48a5ded
- SSDEEP 6144:SqXMOt+tcXzsnHKSpLEAhXky1+i5QgsZfGRAxY6CjvISam7WMEpetGx5/RuXLtGd:JDtqcDDAgi5QgsGjZ7C8Gx57r5
- TLSH T171B45C7793769059B8AC1B9378643F154D2E485BDE3B26F7288789AD30A178D0C83C9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\id.pak
- Size 412KB
- SHA256 b052cd4a017c45ef7973471c23b988a9cc01f7b80af3e3434457ca68383d9fd5
- MD5 d4b0372b84a64beb66c82db84e937ed7
- SHA1 af3d56ac6ec22b9e8e28cdff9e5dcaabc63d2612
- SHA512 1f4792d387a222905a2e01466dfd7eeda9e662b4f855f37ae8e4c36eb52914b0b43abcbd6dda9d594fd2bd12326a560be06812c949e50fb3c50e39d38a50cbb4
- SSDEEP 6144:NjGwWOSLyHBBnr/UjSfjtVnjHF4RmP28cbN51vhIvtfhSVsEan0g:6tL+rkCVnjHFum+84N51vhKr
- TLSH T15F94F7632EC9310C494843E5B2C9AA1E7CCD233BAF05776F8E748FB055A67686716BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\it.pak
- Size 463KB
- SHA256 88948c75519e681ef15bee3a26e159556e329baa2cedf334bb6d7c674b0b0416
- MD5 148b9522f1a54f202cac3c711e3c19c2
- SHA1 e8bb63efb05cb4c2058d9c73558eebf451e691fd
- SHA512 9d781817ac93936d035ae3e7bb0d9884dddc643b71b93b7aaa25bd2ccf1acd1b26259437b3cebdaacb0b7a4169f8b891276a164cc00f646c750d95c73278dd89
- SSDEEP 6144:EA1a2j3mnEpvpt6SMFwgSrqRrhsO1/RT9TeexAG696ELWqtKYV9fLwwQ2KKO2I8L:EujDFSZUi8KMwlwIR55zov
- TLSH T107A43B36A5D621151A976369E211B045FBAEFCCCFE417218C99B431C23CFE84E1ADB87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\ja.pak
- Size 562KB
- SHA256 95bf7e0cb0b3ec51e151aef9e5653969fbfa29f52a6f3db2d84bf2f017d9f53b
- MD5 50eac9f852f91e2e6bc5c4ce33948900
- SHA1 e5488606ff54a67b905762daf08f927710f46fb0
- SHA512 c4c9054109ff03fc17c2aa8edc2329ffa54c92c4b79ff361665fa4d3f5490a1a3069f25124eb4bbd3358e4b9ba44d65e2423fcf260911b76fd49683657519058
- SSDEEP 6144:aXcplpPkVi4J5TESym4ZKs2Ip+gb85am/tIxV6:aMPpKi4H4ZKs2Ip+D5am/d
- TLSH T176C4307CE3C569369D6192A22C0E36E17606AC5FFCA2363A442DC474BD70BCEE415AF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\kn.pak
- Size 1.1MB
- SHA256 397f1e8f20071367c36056b15fce206ee906968630ffd5b0171e41a821fa1657
- MD5 5661919f44c068d3f602973c266e5cd3
- SHA1 77b1a25279fa6d4b5b5d8e6093be351634d0a6d3
- SHA512 425b691a1fb7fb5a267197153ed84a018421d5c92ae0723562d3ab23a8d8b196081770e8e3d20e1d27b9b6589f4ae942af2eed181474bacb78a504df96601dea
- SSDEEP 12288:pGFBbWzmS7y2emEPJpcO7a5y8UU+354pmaH:pGvW2pI5lUE
- TLSH T1CE35CF186DBA7D301BD5006B24EC603EDFF16BD29CAA07D2F4DDD7802C66C6A90869DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\ko.pak
- Size 471KB
- SHA256 8f9db13aa225812047f5e106c3ed3dd87b70f20846bb523e9d844c29b2d23519
- MD5 3d6f33df1404b3dd7e85878961bcbe27
- SHA1 96eb31b0cd3d9c2915c368b8340056d781ee44f7
- SHA512 dd20887cfa42a6b1eb9dda2e4106a55185a01a0517731d613764fc5a68d5611345a2ee221aeb1366b537457ea8920093cf2bceae8839fe45f8e74ca9abbbadde
- SSDEEP 12288:LJUKqj4XO3zAB+x8XE1at8OhNJCQ1CqC5s79Ad8btAq7hUoHA5:FUKqj4wSJI5b8DA5
- TLSH T1EAA4D7F238DB23CD1193DD82AEF4FA198381D976F7430294ED44CE549E645C7488AABE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\lt.pak
- Size 507KB
- SHA256 048c2ea9a5252fe1c6c94a12cc70b3a94a1ded4eb0bfb13d2cb885d8d4728a4a
- MD5 8d71868fe724f500f363794fc4707951
- SHA1 c4a2159f9fbf0f28e07af2b3372c6bd24c893232
- SHA512 3568f06442db3f6d397ef7e2a61bcff6b418fa3505e379e9df258cab47f0ab983f2975d720e88ca95f8ddba01c7faec3151a6c3b3e7457fc3cf5b977747f07cd
- SSDEEP 12288:YJrChE+fMykvvhe8Torgq0577zv8IJ9e26SN:bEeMPEvT05oIje2
- TLSH T1A7B44B0079D3AEFB9A4467CA81A4DA78CEFD50005727B861EC6DC78AC43BF4625A4F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\lv.pak
- Size 505KB
- SHA256 095d894c1b1d8f4461297f6124604d165fe7936583ded2482f6d5188100c1283
- MD5 5c66c9cf559c70c32d19d18ec0fc7c20
- SHA1 8a820e24897aa61c239e792b979d82c4b9ad1bac
- SHA512 7539ec8694d4e09f32e75cf98335203ba556fb1c04d3105ef67c8c6a51a95e7c81a3f09309655a75d30b64fef9cc04464d8e54d58983e31e50c71c0183e1e361
- SSDEEP 6144:lytxD03/ADENTtVFHDPc7f4EG77i3sb345/iZanXqER9AIil44XyEA5FoAl/h3:03p2474Eyiw45gE1myR/h3
- TLSH T1BBB42B559EC68FAA4D909DCB7337D122ADCCD740FE06E112ED6D4B3A520F12422B5EE2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\ml.pak
- Size 1.1MB
- SHA256 273aad7fa5b0cb0a48dcb0a8170ecd5c1d3ef833f0fc0e5834630ae869e5081f
- MD5 a1f6d1e08d1251303726375171f6fd10
- SHA1 7dce0fb7eceeddcbdc234705de71b3d4ac14b855
- SHA512 6ff2c0052bc3eb6b649c3ff8635e035bfd6daf2bd360ac1d6bc7dbf0839d895078413e92f3c2bba8b28ebb6acccad6779f7ee4202374b6b74096fad79c472455
- SSDEEP 12288:XTBqigj6LLnaun47/w7njxlc2MmWDcZubSAeyKhSE3eGhz52/7d9Je3KZE:XU6yuWWQE3eW52/71e3H
- TLSH T1C245AC5BA036CD3B0FD002257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\mr.pak
- Size 948KB
- SHA256 83ab733b19bfa52427c6a5c6342be6b6e8e863ec7c8b22287f2d2b433c258203
- MD5 0e1c2b8f5f2779979b7377bd15492e8a
- SHA1 51588f53c3424bab9eb5a4325e155569e13c1970
- SHA512 a4277a120d612a24d8a1b008ce427634900e22f5004839618f8a962cf40f6b88c016be83e2a9edc06c53c1d7f8d40c003094578dc9d16acfd02898f06fe3ed65
- SSDEEP 3072:Ev4GIIvo3+mD5qDfiNzPIJRCqpRJGVXXtt9FAyFcMU9G3GRe3RQR3Kz/Y2xi4noW:ozvoOmlNcReNDo/d08Te5Pp5n5VMQ
- TLSH T11125D24DF77AF3685DECBC8E36580D3BD8FD21B1C3E9925648E1B3A74884CB401596A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\ms.pak
- Size 431KB
- SHA256 0fbd6c36305bc105386674effb79f921ca7aaba9d3ef4e585a9970812f0ae975
- MD5 7f1fa6962454f8f20cf2b36c051aab1b
- SHA1 8067996300fba3f2708cd37ddc5e5e031f23215b
- SHA512 0f3e6cdf3ebae97957106c87d3c7c8f3f82e03fe224dd90d0b0704bd6bcead36c1c2297805a2952d4a1cc32ccc3fd7d1eccfdbf9014796ab72414c951620be03
- SSDEEP 6144:2Ihq14CQ1Q6rsp/vxJflLHlUo+Q/YBIiw5ZPgUXMMEC3PZ:2IhXC69gxJJlUfyYS5+U8Ml
- TLSH T11094B5069EDD3118096843D9D2D9691B7CDD3333B705AB2B8DA08FB012AE7E53716F89
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\nb.pak
- Size 421KB
- SHA256 cf93325eb9c95c54b4c6d6449709bb77906f56c014c10d8d3587adaa28598e45
- MD5 aac779fd617aba12448f96322125826b
- SHA1 63a324873170adf6be40f4e5c8361e966642cecd
- SHA512 5dac055e2b65cb12c8ab28b2ee8fbcc1084724b4e33b011c91c2d2c8c9bb1c5cb7270ed0b9a81011dd40cef1e07b03f43fd8a453ea4e8d36b613b273402ede61
- SSDEEP 6144:pFU2KL85IhSedl7Op7f31LgMmQP7spZwL4d5+f4nVHOQ7lw:3N28Bedl7Op7f31/s7O65+f4sQpw
- TLSH T100940883EE86B72EF6A447A4F41895479B6D943CCD88199B64CCC63E09C7EF092BD1C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\nl.pak
- Size 435KB
- SHA256 a6c435fd650e8e63287167623697bcc056d7234251bf5f8a45a01ea4c05cfd31
- MD5 ed0fdf6555e64117abbb820e7888001d
- SHA1 208caba7c8d192d6bd89800f05a757df46d540b0
- SHA512 dfbf998c08b9f436c68bd865e7584d326d4dc187eb72183f18c3cd67d2f741a6813cbce5aac0e5cd69af188fd26f7d081f3b8b6053548d5d3e24d906f84061ff
- SSDEEP 6144:NO0Z2uyTcDBWgDbT5S1H2pako3D+qnC/gi5qI8xRGpsngWgHP9:t27xgDbT5Sz5ti5qI8xRGpsngfP9
- TLSH T1E494E817BC8D253E19C0A385F6054FBBBF2ED22CC268E67D94DDD1391453FA881AD889
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\pl.pak
- Size 487KB
- SHA256 973cdb62afd56de9ae67154b1a0fc55ce19c901e59ea26a57088ffaade7a7704
- MD5 b64ed13017c3e0c4a5577ef17cbd2c9f
- SHA1 d5f518631d03725ce27cac8a17db463e8889d464
- SHA512 f08829087696e83277c8a66ad52ba9d99a3daf894216a8ae50aa108fb439545823fceb69dc18d2835467adfd19aa8b6f116ed494c9e9139fc5a90592da55afb5
- SSDEEP 12288:X3NFntWoOB/+YjSoM5/7+Xgv3iW6b1vPiCUdTe3mzU+RhmhF1QhwOB5YvE4Y60:tFntaWRI1Qhd5M0
- TLSH T18FB46C0E96E59A0E4DB008E6F2E71B3CACDCC848F109D35FE46F452A615B19EC9BE5C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\pt-BR.pak
- Size 458KB
- SHA256 2a8cd67a9150206b371388a9bdbc6cc91c2fba9c55a0d1b235c36a990627beb3
- MD5 c0440288fd25960f31c726b229ef2ff4
- SHA1 39922ca4c6001d02633c133b1723799a17fd80ac
- SHA512 4a17594d65f333b7991904ea7b94d3db1fa0b1aa93781f66b5b05fe2c7369cfa33dad11fa5ba42e77dfd8af4cc1917b18907cf0a22e5a35c93fd1853b517f132
- SSDEEP 6144:tElCi6tNBXBLJ9uHECUGy/u52PJkms9sRkl+Bh:Q6K5wJb2sRwS
- TLSH T137A42B2A6DC9136604229351B74ADB03E98C5645FD0ACA8BDCEF4F06A3DDE40DD33BA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\pt-PT.pak
- Size 460KB
- SHA256 0092e627e213a069c54c0d948ed7a25578a0f3611f2cad545d7554aac32c8efb
- MD5 bd0d6527bc6fd03eec4f0e6262deffa3
- SHA1 2505203275d95b819c76318fbe5a11f2fb783bfd
- SHA512 70dce6d5244a34dd7b3e05d4b89ede2c35bd7b6f84203d2ff8c24525096857ae6cb03f1a64d78b2b4e869ef363a25bb2d1fd914dca94752137b0d4da707918c1
- SSDEEP 6144:e7VJPUpa36RutjnfieJVJJxh+Dlx/eXfxtO5uKSSRT0q:ePMpNREKDsO5uKSSRF
- TLSH T178A429296EDA132605225391B70ADB03FACC6655F809CAC7D9EF0B0672CDF84C676F61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\ro.pak
- Size 474KB
- SHA256 2572b68ff916a96392f9f44c36f57071862a3a94a88688effafc23d06ecba39c
- MD5 0d82e198e164b73e0f98182a46ea7e72
- SHA1 0228cb2107c54edac93c222f6b3f2752d5c9301b
- SHA512 383fe8b7c860a1b74ea511a20c62921216e533a060118cdbe5e6c387c9b476a35b468f654122009822c1be3f5261c3785571f3f0f384776cc36b22295e211059
- SSDEEP 6144:6cNW/GpXyTaoFt3G4x27m08B/5gb2oZs2n/bOuMqR:CmXyHFt3G4x27j8B/5gCod/lR
- TLSH T1FDA43C23A1C85A97299152B2B73634D3EC8E105DFA41D28DA4DEC97C10CD9DB852EECF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\ru.pak
- Size 777KB
- SHA256 427e8b52e52f3de45392ccc5b356baaa2561f17f5361b8fb35ecfbd857c54dac
- MD5 8f6db59fc8baf8cd1c7e4833b0761a71
- SHA1 c500fa77b438c055be51772a5a3fdf6710f78630
- SHA512 99e2abed3d439ef4dccb2ce8da8e65f7dcb5347e0b41905b31a4f5524a0fa5debd2efb2380cbe18ae6a912bb8f862c4ffbd315b286dd559ae11e4bb965f9ea27
- SSDEEP 12288:5Rp0z+iIvisNkgAypY5eXN2hHO3j/jcwzvMBsWAekzxe8P/XHFGGJHWPaZuLZUFH:D6K5s68g
- TLSH T12A058761669E64DE1201F01BDD08BE0D7CEB45FE3FABA31619642D7E35F2024C63E61A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\sk.pak
- Size 490KB
- SHA256 a25deaebeee7e1838fd95f8fb3be88b752f67e73904321f57e5c60908a77d527
- MD5 c30f6c09680857636eefff9ca64ffc5e
- SHA1 0a9fe155cc82cbe4ed2a80540d19003e113d9fc6
- SHA512 7bffc919c11a97c090cd2f4fc6f99ff55cc711f115cd41276fb1c47eebff44cdc4fa29b2024bc347b6f7c26fca3eb3cb9d60b1955dcc1e39bdc12c52be6ab16b
- SSDEEP 6144:Jwkw7Wi6kW/kM65bXMoRjyqiUJ8QN3a5yx2hLTaQ41DEmLjdGI:JwVW3/klbHtyqihQNK5yx2hLTaQ45dLb
- TLSH T1C3B43C3FDBE6180E8AD90148EFEA7110F9BE4690894EB4A5D40F368724F36EDC978D45
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\sl.pak
- Size 471KB
- SHA256 9f954e3bfdc03ecf01871a3ae9851d5cbb7c16b15f61ddfc57d54bb2cbbadec8
- MD5 d5cc8145aff9cd4bea420ff866ee0a2a
- SHA1 47847ddf27803c0b4586b7259ecfc3e7d0a8a2a8
- SHA512 23bef87ba0f1ce443055eb2c0b61bee13735a92a152a3bd6ecf90ff2a8e2e8efe1d3906455dc19284c07efcc31cac721fb32fb51058bbd783326e32e57d927c4
- SSDEEP 6144:zO4wJ5r6B1thZM7B2zi2i+4nnbANjdnBMlm4ocyxPbPDYYgp0uEcrFGftjQLh05P:zAT7B2IVtAD005O6cAVVOlJGi/fztzqP
- TLSH T19AA42C357AA79E0F0DAAA2CBFEB102007FDC049CD646A6A1FC4F336D5015A3817BD599
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\sr.pak
- Size 724KB
- SHA256 635abf8fcadc7d49a68a7b63aaacce4254ec4552c54a66c69de0d025142fd9e2
- MD5 921531aae473b561858ef74e2a39985c
- SHA1 69f29c07c6c33dc880875d3a09b93010a00067b5
- SHA512 3bf8431daf0b234daffc179bd61fe0f94206a9abf89936b3be436d53adaa635d7f9308e80fa9fd0ae74c99b6ff184d2e52774d31b84420fb0dd4e2d1bc2bbdae
- SSDEEP 12288:JQuQsZR007HjmKDuGSvI4Ki1U5L/TqTme0M58Bn9xRwoI237LJnk/k/J:wAXueKSM5ExOY
- TLSH T159F469A19B9E64DB0501F41BD808BE093DAF41FE3FAB975215201DBD35E10B887B939E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\sv.pak
- Size 425KB
- SHA256 20491d9158bf12b41f4755e0c6d0b18a67768c7c3922a1d865e7fddfad5a094f
- MD5 39af2c859bd7bf23e611eee0e26e9b9c
- SHA1 8667e5765c54ba9fcbc77aca7d42888753a67947
- SHA512 53d8cb776dfdb53df615687d2a5e5c36dd8327a59003e1eea33392acc912aa95d56e999369c864d2604d2c4bc07d61b89e14e70d52bc531539a4982fe350403c
- SSDEEP 6144:lCysk+Fy8WHb8Gj6wHhcB7xhQXSj4SLXrv9M1SOzDE/xWcqpv4z5CN5nEgbs9z:lCyWFybTCB5r5y5no
- TLSH T1A8944D039A20F526FB72530DB608115B0AEDE25CE6E2948EB8D9C83DAD8BD5405FF347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\sw.pak
- Size 445KB
- SHA256 01695ce48426c001e209a06802e6254e7f80064e0d6ac7c2869b704c4f581cca
- MD5 5381ba19ccf70810bccebd6f9ab28be4
- SHA1 8f73587afb49671af7c0a8ce5e334f66d3a3ca35
- SHA512 929a8f4a6b5989a9cdc535313f18219d93ae46eef0af36db2653c483dad2caa23446ebd289bbdd849d3426ba8c04b18930dac3c95fd04e16c7980e4796316018
- SSDEEP 12288:LeJtjA+QcDJ5Wqi0UIbQuBnLOO8iJ+gNATS573HZsPToe4t2hN:yJtjA+Zr57o
- TLSH T1F5A4F8629871E0191633518603DDFF731BDCEC9C2D3728936A46BF4F218F58896ABE49
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\ta.pak
- Size 1.1MB
- SHA256 11fd5c80ea2ae479cccbd081d2db40368b201bbd7d69dc64ec22e0b945dd6708
- MD5 ff01efc5f12d897835b3a5be97306b9e
- SHA1 b07b20080c7ed020eba92a393c6a25b85dd5f0f1
- SHA512 b8cce693233e3e76c430bdd2181eaaa540bd900c8ba44385fee5cbc8f72883a6c5f74c6b923564d6e275bd39d7d6420303fc56203f7a2a4ead6c86af4406c361
- SSDEEP 3072:Ou+NDphb2ALMpCoPooYC/9wkthAa5MS7zMtRMcA2pS:OuO/ACE0C/9wkthAa5HzMtRMcA2pS
- TLSH T1E8450CCE923EEE890F93288F0319536952986155C07BE3A67C756E1298ECC5DCF3427E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\te.pak
- Size 1.0MB
- SHA256 5931f7e3215ccc8d666ff8092f2b3f271352b034abc623c7da7c15052f367607
- MD5 cbd75456e56e3f1fff4d07849b44437b
- SHA1 3ab9c7d2637d8d12ba7c72758f992cdc216753e9
- SHA512 69a5e744813953df012c595158d7ac5ea9743a47fecc5e2b7473f46f9fdc046bd8f7f4d98532c053a4a7c8b99adce0320b8398f25060a434a1d8207fd1080fd7
- SSDEEP 12288:jurht/km9HsbwxrWHABI3p1F9yviTlw2cTgaNFOvgr/p54JEQJgw4taJCb8+58Xp:zoA5fMUf
- TLSH T1833592023A6AD310DAE70273752CF66C49681B4261D6732C1EAFA357FB87D7E0843676
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\th.pak
- Size 888KB
- SHA256 def4457cd0cb1440f197329b3bafff8467da80e609e15f66b04566063e006848
- MD5 c8750438a066da97a62fcadd03939aae
- SHA1 a2cb8b12afb066ed99b00f8498dc2e436a5aa935
- SHA512 e1b515fc0d3c26234007ddf77803c1b4d8659b06ef25b8cc948d6bc249e525c8831548314c631085d48c4bf79c72c12f10da01f1c3b831940a80716b955f3d17
- SSDEEP 12288:hAF/8qO3tjysX8pAWgs3s5UWqpLRflssB/j8OKGr1loIG2EeuLAD87Kle9dPu754:h48Xeb555M
- TLSH T16E155C737247D9D479441B5B262A77896B3DAE693F73F8E00089215A73F071A8422EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\tr.pak
- Size 454KB
- SHA256 5b9b785b191af3cfd13f4d95605b4d4c2cb81d7cd84a3c6d32a2b1b1163dda86
- MD5 daaa771f585f8adcd03e87120e2b263c
- SHA1 a8f6a5e8414266ace80ddd885c7fd7f346935248
- SHA512 0f7a3e1d66db5716efebff67446e9ec4ba69839bd251b6673e205dc8e132ffaf4f87efe284b64075fe408cbc1425a66cb0993bc6b7740e8b1b61e8bf86c5fc18
- SSDEEP 6144:s0QPMuYlXdg0S2J4lZkKLkxakqHKvC1RSD+ngeG5O/d+gi1kTvXwAQwiBx70Go:Dxk2alS+ZXMDr5O/V
- TLSH T13CA4F98178EF381CCBB9278BD3E50616F89F07A6B331E4469A1A9636775635303E760C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\uk.pak
- Size 776KB
- SHA256 917a8e66f18c6c594e62a7ab62381012511e6773b042e97856bc128fcf18d79a
- MD5 a596471e1c5a4102b43736c0120976ef
- SHA1 111af9941077354d6323defccee8a48ebb84dfdd
- SHA512 78daabcc39922d3800ea558b4ca50d541556b69444ebe3548a2839321b2349f84a220253c61157fe48b5ad401c470dde8c52cbcdd7102b969721d5da326db3ec
- SSDEEP 12288:msuGZcnJy/KMkubUpnbKs5wB3Ij3kumEa7KuoLNiXElqBOqz+4uL2ue9:T6G8J5aEY
- TLSH T1D2F4A9A1AA9D54DF0105F05BE84C7A0D7DA741FE7FA6871625A43DBF38F20248A3C35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\ur.pak
- Size 677KB
- SHA256 a7d02ce4f84f43adc4afb969791f65792c103e9573419980e5a8e577f62d0d01
- MD5 d58f62eb9b82905f6ac4fe37e0780c15
- SHA1 319562aa4a5d8707e0d324dac4b2baef5b1a869f
- SHA512 a8d7fe01aca24c9bf6444a2f101fd0d644942f5e8abb1abccbd2acdeba8d53c32ae221d3abf3fc94b8a7fb82738fb0c347f1df33e9eade1a127e36c9c9012c76
- SSDEEP 12288:0DUWfT8PzGaMyyybpMax5A9zPEHbWeFjQYrwulco/9NjjFpvsC:09Ez5JWk
- TLSH T112E410D2E6BC96B24A21D92790D33C34CB635F13D34BF286E52106C54E9A0139F6DE7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\vi.pak
- Size 538KB
- SHA256 8ced7a3a5112bd1aa06b7466304c8bda2bd0223c6588717f814c615ade1bd3fe
- MD5 5564f0e9a948dc4997e08048e65ac49a
- SHA1 787fd2f9dd7941648d4b2a45b3a0f7eec30aee9e
- SHA512 49966839864857677133a2122c99b0a16b320e395c612784dfe302b724afabf758ad4b6cd1c42b0e799c2ccf94c1eb7aaca144cf222190875c72fddf0b9352e7
- SSDEEP 12288:9+WWYa2bUgsHBM0dalwSPTuMFzNbNX5m18EhH4i1+UGCHzi8Tkr8:aYa+UgsHe0dQwSiMzr5684Yi1+ULTi8t
- TLSH T15BC4841116E0702680AC553EC6CD540E6FCAE42FF7C18FE56FF429787A221A45F25BAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\zh-CN.pak
- Size 391KB
- SHA256 2f089dced9aeb1c05d3691a7c699a674c5ac93debf3a62e6084990d903eb1ddb
- MD5 6af381364cd15f9e75987dc50f58ca90
- SHA1 67a4a1fc1695b22bc6fca2eb008990a08dd00513
- SHA512 2e7bf44be43c71b06080b42acd2bd1007838c5c83eec1d890944243d731479b3a92a954bcff1df8bc46b9533cc3a391abd1604fa2b30d2dabc75985330503809
- SSDEEP 6144:iEz/KrFe7SsBaZq79+vKKZGsk39H56zANmJq7qW1lH:FLKcesBaI+vKKZGzH50ANmJqp
- TLSH T1ED847EA911F8BDEC044984D03725613D7C40B10BF667AF76AED248ED1BA2F9D075BA0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\locales\zh-TW.pak
- Size 390KB
- SHA256 b96ab49ba7b3cb01fb9f0704e5bd69ad9acfef23edf951cc0a684b7c95c2767e
- MD5 1e339beb005ae730a12b0b0217dcd8ba
- SHA1 c4f9b63311f19ae7ec11edc8edfa408ba78a700b
- SHA512 b4baa90192181bd4457f3086bf8b7f433abb6d0dfb25cf3ff3860c794fb99ff9efd6bb5230f0ad8f27073932ab4f784fe29df957332a7c6686360f94e14ce335
- SSDEEP 6144:kFVB8YUtGeUJr82JiSCU2eLuIy+eK4vd57wzjTBdZ/9yVA4HTG:YotjUJrlrK+eK4vd57wzpf/+g
- TLSH T1F4847CA618FFDEEF0901F984B7C9162E7C8A746CDD377637FC4928D91E6AB40095204A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\resources.pak
- Size 7.4MB
- SHA256 bcf2ce7f32afada76f3be041493a2ebd598078fd26586bf03f91c3806ee4e76b
- MD5 df47c429c6842ff8051e2cb706306a14
- SHA1 df514a0d462c546744c8ac96d2505715345626e0
- SHA512 af92a6271e7e4f80b4f9683d42dcefb46cc1a8a8f2fce2833219a137e519e3b3f5effc4b7a22137c9909eed035ecd5c5c6ae61ebbb57ab7361e32b27bc1633bd
- SSDEEP 196608:WX29vUu46t0ZlXhc47OtYKWBwnhaKNhkrVPF6eelh:WX2hUu/0lEWGw2krD6eelh
- TLSH T15E763320F364AC3FD088A7B5985C41335B2D558226927C9FB0CE620D9FAC25A4BF567F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\snapshot_blob.bin
- Size 222KB
- SHA256 429589268abf40039e274921cddd6e8ffc751aa40515816ef57138256033927d
- MD5 5ae183894d57202a5df5c342dbb4cb4e
- SHA1 e7cb10240fbe1e23140dfd2848a9213dce31d639
- SHA512 bc4872571a9b1f0139740b7b7182556e95b41158a65d595f5723269f9898e21574a1b1af43fc60b95c242a203260d588f348ff17d72e9d077e22e0990dcb1325
- SSDEEP 3072:dk2UvLLZsfc12GbCj/r+uxjeV2EMz84L/KEeusdG8+R/AwxGRAhlZLzimaFRdI7w:SvsfNHng
- TLSH T1B72455107F48CB16D52A7E71CADA84CC3321732C7E06461BBA82872D3C775FA6A75AC5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\v8_context_snapshot.bin
- Size 518KB
- SHA256 76fe9406057665a75d39afd9abd96ab4ed8d3b9075073489eff12a5647f35eac
- MD5 05e367afad8c4e988efe3e7bcef30602
- SHA1 6c12b0e6da5ed5628d371796d07eddcf6ff1f3a8
- SHA512 36a7c8e6fb6a34ec85d67a155df8ead7540fc6b5cf487a6083c2ab1e1646d0c18bd3aa69b73a0900dd07b929ee7ed0174c819f14890c95bde3a0144643d7d3c5
- SSDEEP 6144:cz5FapiMHg8zpXMDlVYzYNfDh/VFa+LfQG:WaZpcDDYUNrVfLx
- TLSH T1CFB495057B09EF66C5153DB18AC6C4CC32B07A5DAE07050BB7D65B2E2A77BEA2D342D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\vk_swiftshader.dll
- Size 4.3MB
- SHA256 1c502c5224ad9ae8386dcbcbaf3c37cad7da5e11a14a429e0a02c50262af10ed
- MD5 23c7908794e55b97243c4d352c1a79ac
- SHA1 69e22c0bc4d591778b13ddaf506d896d24d877f9
- SHA512 cbd6311c14215b9a91fee0e6364701cae8d1556edaf8a84e939e483f7ab0230258b7d1fac2a8c48a4feece72dda083de7a6503e4102a9c67a6d8054e8700a385
- SSDEEP 98304:cpik41l6rAfwzVOrbKj1kYPaeC3UgHFYALaUy+CAECR9xbz:Q2qcwzVO/7eC3UgHFnuoxbz
- TLSH T10E266D01F650B029E40B21B5362CAF759E71C7306B9646C7DB887CDC6EB85E2963B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Chimera\vulkan-1.dll
- Size 783KB
- SHA256 cc675ab9f4a5890b354fb1674cb02b2e65b2870f87bf1fa33289f9a5bef9b336
- MD5 4e35a12327e9d3d7fcce8c6c41248606
- SHA1 05a313b6d6287c745fd0eb75eb7209895d0d5ee4
- SHA512 94b37bf7ded5b3be2c395afbd59537120c39e0c6f4c607e264c0ab00fb4753d851472938d3dbe7fabe06ec620edc9c0f1ac020bf7348ddcfec97d87d6f02a50c
- SSDEEP 24576:mC7UYUQ5jJZWc8Am6Z5WqDYsHA6g3P0zAk7IW+:mKUyjJZWF6Z5WqDYsHA6g3P0zAk7q
- TLSH T1E7058E16BC48C539C52F31317CA1B3770A7A959163E40AC723ACBF996BE02D1277E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\0c2d95c87a236693664d20d984984588e966f794.qmlc
- Size 556B
- SHA256 c1ce55fe455aaac27af37224d11447ea7c59f3510168de06465b19eb33a63c14
- MD5 164a73be57cf87afb5481bb17d9927ce
- SHA1 5a7cba9a8945dce68db84aa6c76c0f71b0f3a76a
- SHA512 0b72814711b2b2a4add17c1367ee89bb8499ce79a57ab5945862102e16cd47fb7ae0d1da50eaea8d69b9c0e0636eb377c86667fb6b89c36f917c13b0828eb9ea
- TLSH T11DF0E50237A34B2DF1E7CAB82CA61131253BFE212A04C91A1168214C0430B800E70E25
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\0df77bcf9db78de009ca6a4ba8805cab3259583c.qmlc
- Size 40KB
- SHA256 52ad8bccb3749178642570bd15a5b6f80c89d14bb5b21f4b3be143e6f5c9e418
- MD5 241b9da2469b46e166f2904b73fd3cd6
- SHA1 799c330a59b6f4c6b0e4749e79335b02176b73ac
- SHA512 f1c08ab09be516e1a2618844421dd9b529799708ffdc3bd0b141211cdb6523cbc2b4be7a59ec41369d5fad5bd9cd3a851cb7b8c82fb076039c24554dd3e8abeb
- SSDEEP 768:1o7o3+1CEMOcefalqlKowUXzD9Y4vvzvqan77S6fZ5PXUm:otfalcKowUXzD9Y4vvDq477S6fZ5PXP
- TLSH T1180332467B600025DDF2673815DA7B728EB6FF9895879B1BA103506CDC232603EBEE35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\0df77bcf9db78de009ca6a4ba8805cab3259583c.qmlc
- Size 40KB
- SHA256 f616662968779cea515f8a96a89312f775d3340d0dfc9cb6d887e049eb8b23fb
- MD5 71696e82c19b9164422d7c371210b3ff
- SHA1 d70e87848c6dc95ae904dcdaed63132b5299e8b9
- SHA512 03dc31d1fb7e810ecb29bdc72609eaf343034df88eb74c7cab30d2d493eced1dc25c41bd0e869d933752f1a69a6547bd87f3f1b2d6feb4c94b539b8db42b234f
- SSDEEP 768:lo7o3+1CEMOcefalqlKowUXzD9Y4vvzvqan77S6fZ5PXUm:YtfalcKowUXzD9Y4vvDq477S6fZ5PXP
- TLSH T18D0322467B600025DDF2673815DA7B728EB6FF9895879B1BA103506CDC232603EBEE35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\55e6ffc1e4b70a46c4deed01abb9cb1d3d1cb920.qmlc
- Size 11KB
- SHA256 d8848a46eb1bf33302837953ba5e07dd7a38e6183cbe5bff26dadf29d086e6b9
- MD5 7fbc1cfa451c240cd850177372441f10
- SHA1 3c653536066093f4fd1d658bd57c9b060c262dbe
- SHA512 dded8571f9ca29148ed441cd618aca3c595a52f72991077f9029ad8814a18d72b9a79d0df4f1c22f4beb0ba49c1d47719c994a8cbd3c6c8ba21b2d15f5520a41
- SSDEEP 192:fVG4n1dS5iiQcytZy4axKNcRo1fMzDInezh/9LI5IZXyIpaliIuqn:fVG4njPcytZMKNcR+fiEnQh/9LI5IZXC
- TLSH T15F3261077BA01029EAF36B3854E636714E67FED569A3D62FA106506CC8632502E7DF32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\55e6ffc1e4b70a46c4deed01abb9cb1d3d1cb920.qmlc
- Size 11KB
- SHA256 ec139c341d2553b1675701bc3fdc4d290e38350660065da5a16287077af443d3
- MD5 a1663cd39f59f0d3175d9b3b6087587d
- SHA1 198b66125b44de786d8c18f3339cc81950af6de8
- SHA512 06f77e4b0f2f5f2869b6a8046910192cc7b68680bfc9689f32d4bf6b7f850f0804bd97291a78c89f87d9f8b7d947fcfc79e872d99ab6190508fcaad80c508aaa
- SSDEEP 192:KVG4n1dS5iiQcytZy4axKNcRo1fMzDInezh/9LI5IZXyIpaliIuqn:KVG4njPcytZMKNcR+fiEnQh/9LI5IZXC
- TLSH T19F3272077BA01029E9F36B3854E636708E67FED569A3D62FA106506CC8632502F7DF31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\60275f5f6e33c334fc27395521c9281b31d7c5ab.qmlc
- Size 8KB
- SHA256 a0921364ec8f57c3d22ee326a871a5c05edd6c0a95fba5d93f86b75dc12da4fe
- MD5 789dc90248aed37ac87274c660ea7b6a
- SHA1 d18cc67aa3fbc0e553da9643eb0d56ae40d34833
- SHA512 d8d806c0323755a343afde7f941c2b6575c8372dd9e672f8c4ff38c36e1f9f1b3fc8112d62ec7e1f0ebdba71237b141d56fcc4766af8f37e9938170abfebe29c
- SSDEEP 192:ipmwWL+FWuHtZwQSBQ7BCkB8Ptz6qYyXa/Du/nP8XaxE1n:ipmwqCvtZwQ/UJPF6EXa/qP8XaxCn
- TLSH T124022F177FA05015D9B2AA3811DA3A319FB7FF906A83DE1BE14250BC98235502E7DF36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\619572f4c59c16656b0e91e66eead08b0e301f06.jsc
- Size 17KB
- SHA256 7aa619ce794df002be497acfd020df5af2815b9bb773f31af1ccbc89ae53fc15
- MD5 20c2d6ef95366bc0dc519c8405ac702c
- SHA1 0046ff9d83ee32f9023be942581c34c9b6195101
- SHA512 48b6db343844d55714c0d79a31f6897288bf2dd2fd27f65d7daa3ec26d6c9983e2ab6b01dc2273bda5f18357c8726da151607b430a9365d6ae8af270c07bad07
- SSDEEP 384:gzznjJ5X7SQfnJQk0QSk1qSLxv9xEtZEMCewy:8FfnJQk0QSk1qSLxv9xcEMTwy
- TLSH T14E826C44B1A10034D9BB573917E7AAB50D75EE0A9C16CB4FE801B46AC9236207E4FF3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\7225451fcacc3b7ad282a5fc4489dd7ad6f3e571.qmlc
- Size 1KB
- SHA256 bf4cbaa99e9879e1a1ca82a379c45714cbb9cfbb470d71abe834e2b174a32f54
- MD5 c0e6c43f59e2d5abb8f7e6afe42bebc0
- SHA1 cfd84d57bb04527b74dfba222848556d56444683
- SHA512 bd8705d5bd7956d5655d380a40c2f81e8e23de0fbdbaa8daf3bf709c821f28025be9474854890e94eecea12c245e1a34653deda17372eca674be614faaa9ffbd
- TLSH T1C02159622BB10B56F0B6567428A73A301E77FA657F49EB1A6424209E08A1F841D35F22
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\74d68ec5b649e559a06b9b9d5e1a5dd963191e95.qmlc
- Size 59KB
- SHA256 ce1eaaabb51fec4d35b047f7a3c10570587312ffc72998345d0a977be98b9478
- MD5 c2f12e56a01cef2e27a136909cd8aa07
- SHA1 edfbb1d809252ffb38c2d4fe038ebcd831849e61
- SHA512 4ade30cf75cfce849d4908ae8b920afa163363834cce50e720e2aff61eaeeb0ac2c3055445a2aacfb75cf3a71a11908ba0ee47638c253d7a8ba90ae2098fd3ba
- SSDEEP 1536:uaJNeIVWjRHDGv5A8BF/GQCX/l07qDBi41aoTSiFKwlCcS:XJNtG0kluOr3PfbS
- TLSH T1775355077E20506DC6B3A63805C17A709EB3FE99798B5B2BA15253ADD8231503F3EE31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\855acbb4b69d22bf866f679258381bd20317f9d6.qmlc
- Size 5KB
- SHA256 7f640811b489bcf46b511147aa4627ae8c287b9adc505bedd44f640318b098b2
- MD5 5d9a24065a97a39ff89ad6da240a9472
- SHA1 71dc7342088b08900329743ac34f569fbe666a20
- SHA512 dac32c866fb090f7b6b739fe0ccbd95fa601ba74bcd16e8ee78cceac179f02d2dc468058e6146e7057257324954619117052bf8373a6de38f5ac95941b49fb13
- SSDEEP 96:A2veSGtIbl49iyF2S9BZwt5zLIfL6EO8DWjloLIfL6rtBWjloJeS7RzeSFnZwn:ZlJt5fIj6EOO6laIj6rtB6loJemRzeQG
- TLSH T1DAC100067BA01029CDF23B3815C73A719E75FF64A583EA1BA113916CD8335543E6EE39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\9764a0cf7398d05f1f046dc0c358adf765f28657.jsc
- Size 3KB
- SHA256 d3a545baf01f600ad77d32927ebfb4826c861259639659f8e6b9647815c1ca5c
- MD5 649a145727bf9ba80218dda49d7cf183
- SHA1 8ea76dabbe5b5eaae8e13a981d8e2067aecd5ca2
- SHA512 5dc4a29a942e9c0486fc8fcd0e41b733559b4825df3d226179793ba24fc719f0d639d2fa9facc04e7729e5e700b7ac790dd943411d5e7d9e211ba9d6c7a5531c
- TLSH T1E4618B09B9901075CDB32B7902C7AB706CB5EE99958B871BF442A0BDD8533A03E5FD34
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\9779a7429fce2510e47ce1a9b32b01bfc446a599.jsc
- Size 10KB
- SHA256 ae51a54d816821bac6cd245d0642e9383d6a724fd421fc01b44d6045db8e7cef
- MD5 7a575a60a0443dd0e9ca1c2e2f360beb
- SHA1 f5b666dac3b7f2ada77001bd9c738cc60accc256
- SHA512 684b5da492e34e9062592dbb44f9e0502931dad15bcf3b445170a733f80c740190c085f64cd91a63ebfd3724b4314c6e17fa1f71cf915d04b4e6764e6095852e
- SSDEEP 192:HlqwQwu3tb+7AbrxvRfOG4Vagkr45zahG+9FNW1FqP4xMQHn:k1wu3tS7crdRfOG4hkr45zahG+9FU1F3
- TLSH T1C3227E98B5600069DEB12B7E05CA7BB14DF8AF9D5547871BE40364BDEC472A03D8F878
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\9d0039b0fe340d9cfb3825d2bb6919d970b2c9d4.qmlc
- Size 28KB
- SHA256 fe2ff5caedd3d77c318f48b8eac15befd04301ead2090df3f093cc17daafee3c
- MD5 9f50738be1320ae36674808badecdfe0
- SHA1 f7347d4b03a1ad776d9d793a14d1f57702def450
- SHA512 cbac2da01f41bd12a01bc5c123d5d9f5c17b8071ead964c9c7b8fbab52334b41d3976503e495f03402ccc87ae1e8d562834ded59d642ad0bce97842e593eecc1
- SSDEEP 768:b5OpeyEy+nhfiOmqerorwyyhxxACG2028WtkYh0h3hz8rPy:bwpfj3qBMyyhDACK9Yh0h3hz8rPy
- TLSH T1A2D21F177B600025DEF2773C51CA3A729EA6FF946983DA5BE10351ACD8131602EBEE35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\a71b4e93e2d222e3e2b674d5ab81791387b77822.qmlc
- Size 26KB
- SHA256 fe6658340b1b39808647dc0a87924a4400b15fb0fc2e861f6d238167790def22
- MD5 b7e2c29fe86bdca25733644656cc456f
- SHA1 e91d0140b861750e601ec1b2dfe52de2dbc462d7
- SHA512 347ffedcd39b092d21b3562eaddace21605acdf2d15edf726625bc03c16e24f6c25e2fd92dde1e838894735af936642ad9666c91de5c8d818f9a577e81aaddc0
- SSDEEP 384:E/DMi2m2DZb5Epo0tpySk9eCSlStPyS5pM1gORsER+j50qDyDrCNCiL6RKBFS2Sl:aj295EpcqPNs4RUhHeZ7leDZ6
- TLSH T1E2C22F077F605069E5F3A73811D67A319EB3FE956887A61FA01251ACD8232502F7EF32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\a71b4e93e2d222e3e2b674d5ab81791387b77822.qmlc
- Size 26KB
- SHA256 1b62fcaacf5405ac1293e399b1cd27203f9a228bfdaf80aa1d7ca1858df64ba2
- MD5 71368860d3410ec2167f424873d17c55
- SHA1 60c4db27719e131a677e8e3610500cd8d4a8216a
- SHA512 73179d566df257fefbb95e7acaf0f1123e36d9c3f2b982f16a0db0c076fe69627da4ee662490b648df4f91fb0ee085b54443cd77e5d08d9b11dcd85db0adcfbd
- SSDEEP 384:j/DMi2m2DZb5Epo0tpySk9eCSlStPyS5pM1gORsER+j50qDyDrCNCiL6RKBFS2Sl:Lj295EpcqPNs4RUhHeZ7leDZ6
- TLSH T122C22F077F605069E5F3A73811D67A319EB3FE956887A61FA01251ACD8232502F7EF32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\b34462f8ca5a1fbd077748e2779097689f9300f2.qmlc
- Size 54KB
- SHA256 38c48886879400d164ac7992969398ccf2a71123e26e7b84abaec49edd1f815c
- MD5 7b62f94e25360ceaa96219ae14542402
- SHA1 933c37f6c9f889534d57e35f4a115b810c89333c
- SHA512 7a995501dc06ea8353fdb9b3858674f453be44566966b683dc634ae655be4a607dc6fd1ad0be66d35bd3a62a3b570b36c69cee6510e8b1848ced55fd3020bc70
- SSDEEP 1536:dyItZBVY7YUNLCu9DhI3FrO0IhmrPwOwRwRmIOuNjAne1MPS:d5ZIEUso9YxO0gAYzGwi3KS
- TLSH T19C43EE467B601025DDB2273C51CA3B729EA6FFD85687DA1BE10354ACD8231603EBEE35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\b34462f8ca5a1fbd077748e2779097689f9300f2.qmlc
- Size 54KB
- SHA256 835e00b2dc8f4f84807282c0dc5ec3c3e0b8dd5494f58d2e4374890f8e1029c7
- MD5 2860eb9c68e2ac1f6d102fa45f662b7c
- SHA1 63824f5c12b532b57a3b1750abdbf1f9ceaa02d4
- SHA512 92f4edbf8be32c66cff279d637f75e6da2194e6ca8c0bff8920b1a17de91daef0fe2bce2a36bcfe36bb0039e6119e7e62c86ec5de50648e1968b0c422cb9887e
- SSDEEP 1536:GyItZBVY7YUNLCu9DhI3FrO0IhmrPwOwRwRmIOuNjAne1MPS:G5ZIEUso9YxO0gAYzGwi3KS
- TLSH T1C843EE467B601025DDB2273C51CA3B729EA6FFD85687DA1BE10354ACD8231603EBEE35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\c45e0a706eb6ccbb094e556ff56d02266ca8f60c.qmlc
- Size 10KB
- SHA256 dcd80e79500d4cef71ef8a6feb3f8f1db31cafd631e365dc4030df1eb6044c7f
- MD5 0351606ba1b01d033dae7f8024871cc2
- SHA1 f5604fc469c016b6bea67a3bff8fbad3d3eebf43
- SHA512 f38a9650cd93ebbade2900f86e0b91525a148941606055d2d7469ed8f6371c69e19a8874d7e39677ebbd9a67fa6178bc1b6c5aeba987293d8cd60d6ef2e20419
- SSDEEP 192:G5QzG5t5JohhqThbUhMNh12hevh/whQphJyhybhD8hUVhd+hm3vL3yn:ut5406AycyAqkqwS8vL3yn
- TLSH T1D622EE0F6A102065DDF3213822C67B318EE6FBA45687AD67A28291ECEC531543A6FD34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\e4ef80837691d5be54fee0047ddf51951a963467.jsc
- Size 3KB
- SHA256 2d4689ab71f2844615a7b9cb116617f6c27a89106723fdffbde46ce6bc716915
- MD5 2535406f044197717b7676e50d48fc07
- SHA1 045855345daaee18a21b17246f02df39d75ca0d6
- SHA512 be2363b8ebf67ddf7a0bafa5b8721c1a1713574c9b0cc447ee884f58743714de4071758b76f6f7439ec5f1670b5256ab781a18d63c32c1ed7f56d3c83a757807
- TLSH T1C571F226FFA01060DCF2123806DB7B206CBAFDDA59879B5FF4515098C8522907DBEA31
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\f7faf2a6f38c4ddc3148b50cb1a2194b24a5b388.qmlc
- Size 10KB
- SHA256 18406bfda427546f7663ee111831abb0eec467599ee5371679ac1b61096fe701
- MD5 224867cff5b07e5492d195d93c0e50e4
- SHA1 6476adcb9c527671b19bb09fa3367b2486931af0
- SHA512 b79e96e1a9a11aa4bf78051d5571f18edad3a9b62ff1e9fec817dfc82674505cc9ba21aaeea646af9345d08ba5473398bf50fe7e204c77fdca4d45dce5b87324
- SSDEEP 192:gjNclBotza7btZuRQy2TNOgRBDbLM71K1KiSSnwjfHVCj3b8aMfYn:gB4BooftZuRP2hOaDbu1K1K9Snwjfkjp
- TLSH T1413242177BB04014DAB2273851DA3B719EB7FEA56987DA1FE11250ACC8236102E7DF36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Chimera tool crack\cache\qmlcache\f7faf2a6f38c4ddc3148b50cb1a2194b24a5b388.qmlc
- Size 10KB
- SHA256 b33be747d5297567d85f9a05b45027421b534e1cd2f1aef1ec309e6da56c2fab
- MD5 8c8ac1944adb4d04603fb130c09d0bdd
- SHA1 d0d87cd03452ab09f576e294efb6897921a3c103
- SHA512 a45c057155a3f479f445a042b86d0d5befe4586542cfc7353657f631e8ca7e46668088b0c36dd1614e4e6679abf4a2be36f9699a56db1fa41770843443be1bca
- SSDEEP 192:SjNclBotza7btZuRQy2TNOgRBDbLM71K1KiSSnwjfHVCj3b8aMfYn:SB4BooftZuRP2hOaDbu1K1K9Snwjfkjp
- TLSH T12C3232177BB04014DAB2273851DA3B719EB7FEA56987DA1FE11250ACC8236102E7DF36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CHIMERA_vWobmD\cef_binary_113.3.1+g525fa10+chromium-113.0.5672.128_windows32_minimal\Release\vk_swiftshader_icd.json
- Size 106B
- SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
- MD5 8642dd3a87e2de6e991fae08458e302b
- SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
- SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
- TLSH T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Chimera_tool\Chimera tool crack.exe
- Size 7.6MB
- SHA256 1eab59a25b98415e4c42d1ab929951725c9bfcde096709d5a39400fde505d7c6
- MD5 9bb699b6bb677eb47b1aad232da18afc
- SHA1 c59e3341210bb4391f4b44bb7d2f0fb6e189e521
- SHA512 11d33bf3aaad67e3d3c70667e8a3f1837d760c5473e1d2cceae79217bcfc438d4e3e0c35d9f62b81634a3318470db098cc9ff1e739b2f93038895855ddee5583
- SSDEEP 196608:MJC448Tdqth/ZGtPdqodWCU++tBKmaCtzaPq2kQcn1Mav:MB48TMt5Ejg+Pm/eC2kZj
- TLSH T1A68633E54AE09C5DC05299372DE8D9303E2EDEBEFDB58195BA53338813377A328D54A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Chimera_tool\ChimeraInstaller.exe
- Size 7.6MB
- SHA256 6d73c3abdd030c817c1179ba345ef5663455688a487bff20794206df2c365296
- MD5 862ed62122d55c3ccf8a9569a35376d1
- SHA1 036c615109ec554fe995a92e91eaf536c5481caf
- SHA512 4a7cf48fd9a5f1a879bb56234a7bdbddc421da8db4cacd8ce89562041ea3da0b77aac388a5894ba75599dc0b3b1536833fb8c5a8691add37ee39b1aaf842c7a6
- SSDEEP 196608:mnoBjn6NrW719ck+i+fy9ikn7ZxUekUf5Jw9UmSbz/5/U9+4kfE:Bt6NK7Oy9iHJC5J/bz/5/M+4kE
- TLSH T180863393A8B0DCB0E97CF57898A783924A347E91F4E4189F7E1AF14FD430976B049879
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Chimera_tool\ChimeraInstaller.exe
- Size 14.5MB
- SHA256 6a8b7df69be2bf2ba0bbdbc6c27898800bd362d5707888325b239d6f668938bc
- MD5 96fcc75dd27895a625da1022cb31b70a
- SHA1 f8c97eb5dff6a9e1297846e8ae414df48fb73f0e
- SHA512 3df600eb8adb42e93c24d015343cbe984934e16626f62bb60f55ff30b857d251a3a1ab2eef3f88ef3ca5401bd521bddffc8e9ffc9cc6443c37ebbd74a1b32f36
- SSDEEP 393216:doI+jGOgMgY0r8h1EeiKTImo2fElWJaBX/:iqMs8h1lIm4Wu
- TLSH T12BE633CAB7ECDD9EFE190C71817D57F8A2560F819039CED0C96CB78546B01AF722582A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DriverCheck.acd
- Size 123B
- SHA256 045702dff73a269a99eb013c23c22e8750dfb5ec3b26ae11a4a41b6ad26d0cf9
- MD5 60cc6b685669e61e647a1e23f3c899c1
- SHA1 53287e74dedcceb1bbf3e701a056922b6bf2af57
- SHA512 7d6c3df88cc0c8288e666d3c55f02b3c321ae57064129991788d5439678a2924baf8fc92cb4d201a15e5027ae729d9e9340e40133f11dcd262ec32e5133ac7a5
- TLSH T11FB00B50CDBB5183554CCF39400E1510F7F115511300715775D0344300315D8444D40D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Chimera.ico
- Size 32KB
- SHA256 9216a46311c9375b1bfaf86b89b1b93998dd0404ee6b15a62c7a62983af63d88
- MD5 0160c98a5bce74331271dc08719c6d68
- SHA1 cb308f285e5aee96db0f17c8407428d60b310198
- SHA512 45a2f2150ae62409848f79d33982b39d505848833c67cf31660ca8a03669fbdf9856503ec8c50586283ce700da575bf0ec05589758c300eece691edad5007381
- SSDEEP 192:TO/3st8fBkIHt51gnq4DAk7qO1m4ynOE73kV4zP4USff8UalPiqpP1TRLQGF3PtB:ykGLXSnqw7b15iD0DWi+PpBtFq4JL
- TLSH T1FFE26C51790022B1D4ECD33BC1536D0387292F3FD766DC4BA899FE143A62C439B2AA1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\WIN10\ANDROI~1.CAT
- Size 11KB
- SHA256 b8efc0f34ff86763508df2448fe84f9e485febeabf09628ff6f1d211a799df79
- MD5 bbaa423de3925fefe44949e9ba571e11
- SHA1 e77dd4a4e9e72a9c0a2cbaca75b8af2cb8d3d263
- SHA512 a0fb5d37774af537b6be81f486e9ea78b8a70f31da2f7b1b6aea4b73db9849cc7eae624e3c9e752214bbd567613e6ad2b1eff0400de39ef1e2d073d8b8e37ed6
- SSDEEP 192:FTH3ee3K7P9eESuT3muROLZSZuc7bBOuWyLWwsUJZscF8Bd1LPK6CYnJbdUX:FTcxLOZSZ9BqZSZsHLPK6jnm
- TLSH T18C32C82A87D80C41E973DE2139F4A11BBD31B952F964C9FE218BC3144B51782BAAC77D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\WIN10\android_winusb.inf
- Size 2KB
- SHA256 b229457c5bf4d7e1984c4c18e3e538008cf2cf716a172d97350592894e2b4671
- MD5 b473dfc22fd1625c1b1bd5abbde62b44
- SHA1 9922c043b58172c2610704de298b83585a76d068
- SHA512 2db391f0e950d61f2c90af14ab07f5b47e497a4ee8096ed26471b3f40cc198b85e21ae15bdc2222fa2753d13c8d24d544ffaddf25414e2b49b3704ade13e6b24
- TLSH T1EA51CD09530B297539877F2867075CB1E9952140E09E212DB2EFC8D2AFEDD4D01257BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\WIN7\ANDROI~1.CAT
- Size 9KB
- SHA256 b066ba0d433e7b90fe3c76856ed8c877e8347771139a063a3d4b904eeb619ecc
- MD5 7f28a59509341060d9663c0a86962151
- SHA1 9dd54685ea4b311a277aa56a407672cb5b51a271
- SHA512 ea881191cbafe1ebe02172bdebbcc6add23a93477521aab708f18f4b6df5fdbb4a2bced16a1eee6d86e6d2b9d230094e26f476a1076979075dde2d2257c6b83b
- SSDEEP 192:r29ee35eESuT3b7dOu1OxkmEkPy6LL3OxYNf0y28guJFKIgmU1mw:r2lZX2ktkPy0exnJIgmUIw
- TLSH T177122A9F1EDC12926A42DD60BBD6C66FAC3586A7FC18063E50F6879318E13E07B4C91C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\WIN7\ANDROI~2.CAT
- Size 9KB
- SHA256 3b7f299df785c5e9467e9983b2baab596e6e6bafd66fe335dbf9dac08405629c
- MD5 ee75113e3e34c587d9949243316d9a0f
- SHA1 6916a1ee4f865fb3e30733dad28d243142703b1a
- SHA512 ae7a8e07eecad28fcbfa463afcc7102c763e40eebad83cf47417871900fab01dc4fe3a2c18c6e351a12ce34e1b3888c19e69e3308eeaa8dbd00afd9804fb36d4
- SSDEEP 192:wnPeszPeE+uBh7dCCKOxkmEkPy6LL3OxYNf0y28guJFKIgmwtjaPp:wHF/tktkPy0exnJIgmcjSp
- TLSH T18D12E8AB1ED81252AE42DD617AD6C26FBC318B9BFC18063D50F6879318E13E4774C82C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\WIN7\amd64\WUDFUP~1.DLL
- Size 2.1MB
- SHA256 015f26bbcd619a0b67b5eaa985b69582bac27d5cbca99ce747a76532fcde4aff
- MD5 ebf9ee8a7671f3b260ed9b08fcee0cc5
- SHA1 d9688d1849a86dd209732529375c6ada272ff8fd
- SHA512 ea869026b73b4c3d0249beb1fe81efc8b2686d66c5ddf916d314c21989e68a12191efc2a32ef13caf2676327159e95fc4e69100fc09df5a7bbf5c019ea383dd8
- SSDEEP 49152:nFSDIHkg+yf6+ZsYx6h8hL8RWVtma96U1wrfjKClR4:FvHkWpsYxQgttBJ1wLXli
- TLSH T14BA52342ABB80021E5F2AF70A9B946A29B70F405473593DF2360C5986E737D1DE39B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\WIN7\android_winusb.inf
- Size 2KB
- SHA256 70abebac4909dc294eeee25d5acc2bb09569dfcbbd39f97e3dc24136318e6646
- MD5 1b9f79e0e4083f23372dafc8e7aaff3f
- SHA1 cf80190e67fca01b429d68fd39cf11b1577b8a63
- SHA512 3d1d60ec045eabcc99f9cbebee14d6e7cff015794bddf669b5ba8506adc55a5733f3d32ad21a0f11bf50ea070a03d42261ed41be1b06711dd0dcc0039c36fb3a
- TLSH T10C41BD0D530F29353A876F286B075CA1A9902140E09E2129B2EFC4D2AFEDD4C01657BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\WIN7\i386\WDFCOI~1.DLL
- Size 1.4MB
- SHA256 7a6bf1f950684381205c717a51af2d9c81b203cb1f3db0006a4602e2df675c77
- MD5 a9970042be512c7981b36e689c5f3f9f
- SHA1 b0ba0de22ade0ee5324eaa82e179f41d2c67b63e
- SHA512 8377049f0aaef7ffcb86d40e22ce8aa16e24cad78da1fb9b24edfbc7561e3d4fd220d19414fa06964692c54e5cbc47ec87b1f3e2e63440c6986cb985a65ce27d
- SSDEEP 24576:GjG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRA2+:iGtN2h1120R7m4XShYVxfBwrC21fXSz
- TLSH T1BF65234193FE0258F8F61BB0BA7CA9916A397DD25E36D48F12199C9C18B1B80DCB1773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\WIN7\i386\WINUSB~1.DLL
- Size 831KB
- SHA256 ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c
- MD5 8e7b9f81e8823fee2d82f7de3a44300b
- SHA1 1633b3715014c90d1c552cd757ef5de33c161dee
- SHA512 9ae37b2747589a0eb312473d895ef87404f4a395a27e15855826a75b4711ea934ca9a2b289df0abe0a8825dec2d5654a0b1603cf0b039fe25662359b730ce1a9
- SSDEEP 12288:cZq3DFVAZjj5h7OqGDqY66s32+0SLqfhA50yWI7yBoM1oGloLwtxJYnPXrmQlT:cZwoP7MYG+pX501zBoC+wtxuPXrmQlT
- TLSH T1DA051211B7A48271E4E326B486BCA1B1597DB9B10B30D4EF6782A2DD0DB53C0DA7831F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\WIN7\i386\WUDFUP~1.DLL
- Size 1.8MB
- SHA256 a902bb3bff785faaeb6432be76f798627a80b2cc45441e16440e46e6d7340f2c
- MD5 e1bbe9e3568cf54598e9a8d23697b67e
- SHA1 92e15dcab8dda0d4bf9cc9ae98e273567d3ecd57
- SHA512 01a04dda0ee36196054d2cc45c9aea7c9467d9f46ee9cf354d8f93260519bd1968b340dc2be3e4ce966bbb6e332f5aa72f29edc1bfb8e8d19decba7c2df3106e
- SSDEEP 49152:qHAPbyCYhUJodNcmvwwoaehBUfrQHtmr8UQm3:OWyCYhUJ0cYoa0+TQHYr6m3
- TLSH T1BD85236173A84179E9E52BB623BCA6321A3DB5301F70828F238A57DD5C743D4BD3532A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst.exe
- Size 899KB
- SHA256 c74ee5145de7e8c9d3d725bc9de38d59d6b1c5c1f5f6e52dbefeadda72dc5b0c
- MD5 7e103f8e1e4d63c4e2a2f4d09f9c9eff
- SHA1 589d2cb619fda8ff4f493b3dc91879273cdab200
- SHA512 58a13e03507d6547bec6a32fbb49823f487856e8d0e2ae67022c545c180e7a22c209ccd71dcacf6fa5e6e8cd3576b1932345cc82ea20705a8ddba4e1ccf29697
- SSDEEP 6144:XZtaKSpwmx5ATm/LC3fwf3OoU9xkYSr/mdBTRhKWIjsRP/1HHm/hHAM8i6r+LyIm:XZxSpwmxvL/f3vCN1PMaLi6rAyIQjn
- TLSH T1D3159311E7FB8139F9F36F7C697952620A7ABCA19E38D64E1740065D08F4A90DA70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\dpinst64.exe
- Size 1022KB
- SHA256 11ec2ba6a62b443457424ae93cc66382d630d488147dafcfc16b7876bedc2db9
- MD5 c367af8ffd8080dada058eae2e71cc7d
- SHA1 d25cd9911f4d34102e843477d08d256d0de3ff02
- SHA512 4cb4f4474fe16c2babba66a513a82138bbb05c81b82c9ed8232253a9abb47e54d039db95225a3469593ee57feaeb9fa7b45942869af201d15223679de4a575b8
- SSDEEP 12288:IIId79EaUTvwieMozMEcOigSpuPMaLi3s:/IdqaWw1MsbTScPgs
- TLSH T144258004E7FA4225F9F3AB7DA9B152528A32BC815B34CA8F4240569D1DF3AD0D971B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
- Size 1.2MB
- SHA256 d6656414e56377065c602547151b0020469e43c0dcd83b5477f6a2e2d0eec768
- MD5 982e6d4f874437d1cb4caf5e72da0803
- SHA1 2b09240096453bf34d2855d848dccab365f7f71c
- SHA512 a28aef0aa4b4b93eaf49338379b29535f70f047310706611a3bc2f0a3498b0a436edd4ed31373e32dbaf681c2832a9ea611f5052b0251c743543c88ab18a175c
- SSDEEP 24576:7gREWuIhBlB7eMR53ylaUxlbka0R/FzVfzdPqIGx95zVSpwAf:GWIhnJ5iopRGx9rSCA
- TLSH T1C04533C0F31890ACC1AF9A316F657F13B923BF2A9E5D57A36FC0784991511C8A3E7244
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
- Size 326KB
- SHA256 e6cb42ce5a0245dcaf635cd2950b2811ae5f4990cbc11126e2e8e769556144ab
- MD5 ecc57f7d6507c2cb63aeb1f9d18210d3
- SHA1 54fdc4c48690fbc118cadcd119b2c67f5584b4a9
- SHA512 1d24e9b2edd9a76df666f643b592c47439b583b96cab6979a6cf0675e4c0d3b8266227d0ebd6df28f4ed3ad6972a4e9b4b9c080ef8e89d25eb5d033b89b828e2
- SSDEEP 6144:9pF7LK5bwfYggoCQxltnoqhMQ3WxAOj+JzOgm37h:17Igvnoz0Wx8x07h
- TLSH T1F464AE02B293C072D59600B90569D7BA4E7A79714776D4F7AFD01AAD8E203E0EB3734E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\DPINST.LOG
- Size 4KB
- SHA256 6c5947ffd1ce158cf2201673e8731d0a2fa053c3a07969b0aa30524875653b0d
- MD5 48321c1ba90f845a6df22bb42f523fb2
- SHA1 c5ec52e532ff2db5e8fdf2929967acca79ca0085
- SHA512 dd75d2976c939d05de5ce11bbc971ddbc27db9f6af62038ed8f9aff7032906f0d291fc0868ef92a518b5e82bb17968262fae2c5fd9e61bc8b91f39fb4a5b4f94
- SSDEEP 96:tj9dl71Rc+v4Hl7x+o3WHl7BBtl7h9Bmj9x71Rc+v4L7x+o3WL72:jf7k70j7v7qx7i70d72
- TLSH T1D2A17F5277F80D08F2F7AB063AF6D06A1A7A7CE15C35D35C2394814D09BFA01DA6276B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\DPINST.LOG
- Size 6KB
- SHA256 cdf0e8239721a56f01a3ee517320e5b61754a1538e4ab5a8b991a64c34089155
- MD5 f62b0af8321e99f90f6e11ed2971f811
- SHA1 116366f731c6880f216cc49b8ea9b7f23e0c224d
- SHA512 ba02f999594d7ec1e0e5143edd6205beb602964636ee753616592d0578adde133bc3b64d155198849af53294572fdea33bcca8b24002f8ea338bb3e43eef649e
- SSDEEP 96:tj9dl71Rc+v4Hl7x+o3WHl7BBtl7h9Bmj9x71Rc+v4L7x+o3WL7BBB7h9BmjFduu:jf7k70j7v7qx7i70d7h7yt
- TLSH T102E1955177F80D08F2F7AB463AF6D06A1A7A7CE15C35D31C2394824D09BFA01DA6276B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 37KB
- SHA256 50b2f93e145cd3f76f5dd22994a3c68e1f031d2854a8f31eb5ba5d5e7bf751b7
- MD5 7d4868d27565300cdf3822db352c1d98
- SHA1 5d028bf3525489702c7ae1f8a373958ab3503edb
- SHA512 c8300490f03c90072e7b14df7ff45288e2a28ec5a9b13ad94cb757befde1c0dcfec71e1c747cf6530f95dd27b50cf24e6b68b9ce93704c19999943da2739573d
- SSDEEP 768:UUjyKV+awmkLZ4Y8bp4H8u8Fu7KHvtCI8+eCG:UUjyJawmkLZ4Y8bpQUFu7KHvtCI8+eF
- TLSH T1B0035A0891D88829C6F509A2376EDE71C57BE5CAB70B1EE5706C6354DEC2B042EBB05F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\win10\amd64\WdfCoInstaller01009.dll
- Size 1.6MB
- SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
- MD5 4da5da193e0e4f86f6f8fd43ef25329a
- SHA1 68a44d37ff535a2c454f2440e1429833a1c6d810
- SHA512 b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853
- SSDEEP 24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
- TLSH T10485234577FC1178F1F3AAB48ABA84062A767C854FB6D28F0250C95D6DB2FC489B4363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\win10\amd64\WinUSBCoInstaller2.dll
- Size 979KB
- SHA256 981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6
- MD5 246900ce6474718730ecd4f873234cf5
- SHA1 0c84b56c82e4624824154d27926ded1c45f4b331
- SHA512 6a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c
- SSDEEP 24576:aAEBXzGJ7fW6hHv62VYeL7WCE3wixdLZWQzMjp:uBXQz/hPzxRwPdcO
- TLSH T16225124117A48478E4F2AB74A5FB8A11D770BC111735C3CF8285AAAC2E727D9DE38727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\users\admin\appdata\local\temp\_IR_SF~1\win10\androidwinusba64.cat
- Size 11KB
- SHA256 d76972472b9a3d070774cb3fdaa0079dff17ee8437d61aef6f8e5a115905bfcc
- MD5 9abeb153bb0e66001e8051be7b140079
- SHA1 e7269f03c5614a87b52ee35b2f0012253d3bbf9e
- SHA512 7f9ea57dac956f5055f5c0a3eedcf705aade3b9f170dca42aec5a882419af59a943a08fbf9d195a87171f369187bfb465a0b6249fffee50c7d5812beb5093ca7
- SSDEEP 192:gpPesE7PfPeE+uBaCCOLZSZuc7bBOuWyLWwsUJZscF8Bd1LPK6CYnJOOX5:P3NnZSZ9BqZSZsHLPK6jn75
- TLSH T12032D82A87D80C41ED77DE2139F4911ABD31B992F960C9FE518BC2504B51782BAEC73E
- MD5 SHA1 SHA512 SSDEEP TLSH