hijackloader | c819eaf9fd91ed4bb72e62085344d402e7317eb6ded9e6a71663c85a242d7757

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-it
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-itlocale:it-itos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OPFZCRNP.msi
Size 5.0MB
Sample260905-xjcs4a1akd
SHA256 c819eaf9fd91ed4bb72e62085344d402e7317eb6ded9e6a71663c85a242d7757
MD5 debf45863852b6daaa9f51389a2932b7
SHA1 4f4f22158fb10c2c7daa0babe2417a08f4a9aee0
SHA512 8e0319367c3c1aec74a15adb8a4061478b9f6a0d85136af303cd2858391bed48c5b45743a18b65e83c815a98e694e3faf92cc3afe8b8e70ab00b15595818f9da
SSDEEP 98304:ULHHlEF/+mxA3lZ5dFvI9jfqTNUROsONQscG1gg/s78HVMa:iitlAnFsquTONEGOO
TLSH
T1C9363328E8C81313CFC66BB242054D876927FE8173270416B93B3AADADF177746947B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\PraxoraRender
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5d3-41.dat	family_hijackloader

Executes dropped EXE 8 IoCs

pid	Process
2852	Module_Nan.exe
1500	Module_Nan.exe
5180	GitHubDesktop.exe
2680	GitHubDesktop.exe
2228	GitHubDesktop.exe
3364	GitHubDesktop.exe
3180	GitHubDesktop.exe
4968	GitHubDesktop.exe

Loads dropped DLL 24 IoCs

pid	Process
2852	Module_Nan.exe
2852	Module_Nan.exe
2852	Module_Nan.exe
2852	Module_Nan.exe
2852	Module_Nan.exe
2852	Module_Nan.exe
1500	Module_Nan.exe
1500	Module_Nan.exe
1500	Module_Nan.exe
1500	Module_Nan.exe
1500	Module_Nan.exe
1500	Module_Nan.exe
3332	CircuitH128.exe
1188	memu.exe
2680	GitHubDesktop.exe
2680	GitHubDesktop.exe
2680	GitHubDesktop.exe
2680	GitHubDesktop.exe
2680	GitHubDesktop.exe
3180	GitHubDesktop.exe
3180	GitHubDesktop.exe
3180	GitHubDesktop.exe
3180	GitHubDesktop.exe
3180	GitHubDesktop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.GitHub Desktop = "C:\\Users\\Admin\\AppData\\Local\\ykPUYuH\\GitHubDesktop.exe"	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.GitHub Desktop = "C:\\Users\\Admin\\AppData\\Local\\ykPUYuH\\GitHubDesktop.exe"	GitHubDesktop.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1500 set thread context of 3332	1500	Module_Nan.exe	98
PID 1500 set thread context of 1188	1500	Module_Nan.exe	100
PID 3332 set thread context of 3936	3332	CircuitH128.exe	103
PID 3332 set thread context of 1960	3332	CircuitH128.exe	117
PID 3332 set thread context of 3936	3332	CircuitH128.exe	103
PID 3332 set thread context of 7164	3332	CircuitH128.exe	145

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	CircuitH128.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt	CircuitH128.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	CircuitH128.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	CircuitH128.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	CircuitH128.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	CircuitH128.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	CircuitH128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	CircuitH128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	CircuitH128.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF9B67F2A9877400CC.TMP	msiexec.exe
File created	C:\Windows\Tasks\XymaraEdge.job	memu.exe
File opened for modification	C:\Windows\Installer\e5a4315.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C45B4A99-8652-4763-9760-6E3FE097C8EC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47E7.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a4317.msi	msiexec.exe
File created	C:\Windows\Installer\e5a4315.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF144C8D91BF8544D5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF48546D6DB2B3D133.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD16E7A1867CC08DB.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4072	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CircuitH128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5688	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005b2aeec40121f1360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015b2aeec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015b2aeec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35b2aeec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65b2aeec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331080988423594"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3332	CircuitH128.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4172	msiexec.exe
4172	msiexec.exe
2852	Module_Nan.exe
1500	Module_Nan.exe
1500	Module_Nan.exe
1500	Module_Nan.exe
1500	Module_Nan.exe
1500	Module_Nan.exe
1500	Module_Nan.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3936	chrome.exe
3936	chrome.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
1188	memu.exe
1188	memu.exe
1188	memu.exe
1188	memu.exe
1188	memu.exe
1188	memu.exe
1188	memu.exe
1188	memu.exe
1188	memu.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe
3332	CircuitH128.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3332	CircuitH128.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1500	Module_Nan.exe
1500	Module_Nan.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4072	msiexec.exe
Token: SeSecurityPrivilege	4172	msiexec.exe
Token: SeCreateTokenPrivilege	4072	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4072	msiexec.exe
Token: SeLockMemoryPrivilege	4072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4072	msiexec.exe
Token: SeMachineAccountPrivilege	4072	msiexec.exe
Token: SeTcbPrivilege	4072	msiexec.exe
Token: SeSecurityPrivilege	4072	msiexec.exe
Token: SeTakeOwnershipPrivilege	4072	msiexec.exe
Token: SeLoadDriverPrivilege	4072	msiexec.exe
Token: SeSystemProfilePrivilege	4072	msiexec.exe
Token: SeSystemtimePrivilege	4072	msiexec.exe
Token: SeProfSingleProcessPrivilege	4072	msiexec.exe
Token: SeIncBasePriorityPrivilege	4072	msiexec.exe
Token: SeCreatePagefilePrivilege	4072	msiexec.exe
Token: SeCreatePermanentPrivilege	4072	msiexec.exe
Token: SeBackupPrivilege	4072	msiexec.exe
Token: SeRestorePrivilege	4072	msiexec.exe
Token: SeShutdownPrivilege	4072	msiexec.exe
Token: SeDebugPrivilege	4072	msiexec.exe
Token: SeAuditPrivilege	4072	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4072	msiexec.exe
Token: SeChangeNotifyPrivilege	4072	msiexec.exe
Token: SeRemoteShutdownPrivilege	4072	msiexec.exe
Token: SeUndockPrivilege	4072	msiexec.exe
Token: SeSyncAgentPrivilege	4072	msiexec.exe
Token: SeEnableDelegationPrivilege	4072	msiexec.exe
Token: SeManageVolumePrivilege	4072	msiexec.exe
Token: SeImpersonatePrivilege	4072	msiexec.exe
Token: SeCreateGlobalPrivilege	4072	msiexec.exe
Token: SeBackupPrivilege	1400	vssvc.exe
Token: SeRestorePrivilege	1400	vssvc.exe
Token: SeAuditPrivilege	1400	vssvc.exe
Token: SeBackupPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4072	msiexec.exe
4072	msiexec.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4072	msiexec.exe
4172	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 3172	4172	msiexec.exe	93
PID 4172 wrote to memory of 2852	4172	msiexec.exe	95
PID 2852 wrote to memory of 1500	2852	Module_Nan.exe	96
PID 1500 wrote to memory of 3332	1500	Module_Nan.exe	98
PID 1500 wrote to memory of 3332	1500	Module_Nan.exe	98
PID 1500 wrote to memory of 3332	1500	Module_Nan.exe	98
PID 1500 wrote to memory of 1188	1500	Module_Nan.exe	100
PID 3936 wrote to memory of 4740	3936	chrome.exe	104
PID 3936 wrote to memory of 5820	3936	chrome.exe	105
PID 3936 wrote to memory of 5820	3936	chrome.exe	105
PID 3936 wrote to memory of 5688	3936	chrome.exe	106
PID 3936 wrote to memory of 1536	3936	chrome.exe	107
PID 3936 wrote to memory of 1536	3936	chrome.exe	107
PID 3936 wrote to memory of 3272	3936	chrome.exe	109
PID 3936 wrote to memory of 3272	3936	chrome.exe	109
PID 3936 wrote to memory of 4872	3936	chrome.exe	110
PID 3936 wrote to memory of 4872	3936	chrome.exe	110
PID 3936 wrote to memory of 5108	3936	chrome.exe	111
PID 3936 wrote to memory of 5108	3936	chrome.exe	111
PID 3936 wrote to memory of 1240	3936	chrome.exe	112
PID 3936 wrote to memory of 1240	3936	chrome.exe	112
PID 1500 wrote to memory of 1188	1500	Module_Nan.exe	100
PID 3332 wrote to memory of 3936	3332	CircuitH128.exe	103
PID 3332 wrote to memory of 3936	3332	CircuitH128.exe	103
PID 3332 wrote to memory of 3936	3332	CircuitH128.exe	103
PID 3332 wrote to memory of 3936	3332	CircuitH128.exe	103
PID 3332 wrote to memory of 3936	3332	CircuitH128.exe	103
PID 3332 wrote to memory of 1960	3332	CircuitH128.exe	117
PID 3332 wrote to memory of 1960	3332	CircuitH128.exe	117
PID 3332 wrote to memory of 1960	3332	CircuitH128.exe	117
PID 3332 wrote to memory of 1960	3332	CircuitH128.exe	117
PID 3332 wrote to memory of 1960	3332	CircuitH128.exe	117
PID 3332 wrote to memory of 1960	3332	CircuitH128.exe	117
PID 3332 wrote to memory of 5180	3332	CircuitH128.exe	119
PID 5180 wrote to memory of 2680	5180	GitHubDesktop.exe	121
PID 5180 wrote to memory of 2228	5180	GitHubDesktop.exe	120
PID 5180 wrote to memory of 2680	5180	GitHubDesktop.exe	121
PID 3364 wrote to memory of 3180	3364	GitHubDesktop.exe	124
PID 3364 wrote to memory of 4968	3364	GitHubDesktop.exe	125
PID 3364 wrote to memory of 3180	3364	GitHubDesktop.exe	124
PID 3332 wrote to memory of 3936	3332	CircuitH128.exe	103
PID 3332 wrote to memory of 3936	3332	CircuitH128.exe	103
PID 3332 wrote to memory of 3936	3332	CircuitH128.exe	103
PID 3332 wrote to memory of 3936	3332	CircuitH128.exe	103
PID 3332 wrote to memory of 3936	3332	CircuitH128.exe	103
PID 3936 wrote to memory of 6188	3936	chrome.exe	127
PID 3936 wrote to memory of 6296	3936	chrome.exe	128
PID 3936 wrote to memory of 6304	3936	chrome.exe	129
PID 3936 wrote to memory of 6296	3936	chrome.exe	128
PID 3936 wrote to memory of 6304	3936	chrome.exe	129
PID 3936 wrote to memory of 6660	3936	chrome.exe	133
PID 3936 wrote to memory of 6668	3936	chrome.exe	134
PID 3936 wrote to memory of 6676	3936	chrome.exe	135
PID 3936 wrote to memory of 6684	3936	chrome.exe	136
PID 3936 wrote to memory of 6660	3936	chrome.exe	133
PID 3936 wrote to memory of 6692	3936	chrome.exe	137
PID 3936 wrote to memory of 6692	3936	chrome.exe	137
PID 3936 wrote to memory of 6360	3936	chrome.exe	138
PID 3936 wrote to memory of 6356	3936	chrome.exe	139
PID 3936 wrote to memory of 6360	3936	chrome.exe	138
PID 3936 wrote to memory of 6376	3936	chrome.exe	140
PID 3936 wrote to memory of 6356	3936	chrome.exe	139
PID 3936 wrote to memory of 6376	3936	chrome.exe	140
PID 3936 wrote to memory of 6620	3936	chrome.exe	141

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\OPFZCRNP.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4072

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3172
- C:\Users\Admin\AppData\Local\Wallaroo\Module_Nan.exe
  "C:\Users\Admin\AppData\Local\Wallaroo\Module_Nan.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\ProgramData\PraxoraRender\Module_Nan.exe
    C:\ProgramData\PraxoraRender\Module_Nan.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Users\Admin\CircuitH128.exe
      C:\Users\Admin\CircuitH128.exe
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:3332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\ykPUYuH\GitHubDesktop.exe
        
        "C:\Users\Admin\AppData\Local\ykPUYuH\GitHubDesktop.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5180
      - C:\Users\Admin\AppData\Local\ykPUYuH\GitHubDesktop.exe
        
        "C:\Users\Admin\AppData\Local\ykPUYuH\GitHubDesktop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --field-trial-handle=1776,i,11728426175934696542,17388752267662094814,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1804 /prefetch:11
        6⤵
        Executes dropped EXE
        
        PID:2228
      - C:\Users\Admin\AppData\Local\ykPUYuH\GitHubDesktop.exe
        
        "C:\Users\Admin\AppData\Local\ykPUYuH\GitHubDesktop.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1776,i,11728426175934696542,17388752267662094814,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1772 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:7164
  - - C:\Users\Admin\AppData\Roaming\PraxoraRender\memu.exe
      C:\Users\Admin\AppData\Roaming\PraxoraRender\memu.exe
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1188

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:2840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdc7bec728,0x7ffdc7bec734,0x7ffdc7bec740
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,2039020259987184166,6809632673192904146,262144 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,8843181397556604007,5022927150052887500,524288 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,5526112707192942812,12561234447362152032,524288 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,12432927368522108352,7721345309751543080,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,8728453825525984442,4925319653653375177,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4564,i,2362906470316429481,10665303601731301224,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4604,i,12966904333540275090,4565573130152084713,524288 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,2799007684139660484,9560664465782887205,524288 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:6188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5776,i,2540941884645004971,2126639268217638482,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:6296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5816,i,3552459534768806683,17874982325842822744,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:6304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5844,i,12107950856722181586,4173156344725282415,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:6660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6260,i,9642994242334335151,3879118879517080295,524288 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:6668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,12684222084021474459,16832146929718189839,524288 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
  2⤵
  PID:6676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6272,i,201001376786246908,4649676408353082973,524288 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
  2⤵
  PID:6684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6100,i,6634322905552875148,2023224251845790488,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:6692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5796,i,2837240581193822282,4844947397123288635,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:6360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5536,i,15628965892832816102,8984069324714129718,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:6356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,14302911921430739199,17838081434243687339,524288 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:6376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5464,i,16833476914438688778,8788113393678491150,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:6620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5632,i,9159243272547252701,13996831339461118432,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:6876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6628,i,5904611639373852113,17313259509043658257,524288 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:6884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,12844056174879105170,1478302367577681980,524288 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
  2⤵
  PID:7128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6008,i,4429536021703062180,9015741573060945075,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:6872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4864,i,15545592924689013730,9366741018078967386,2097152 --field-trial-handle=1920,i,3694056505104861244,14124721429587806168,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:9
  2⤵
  PID:6860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6096

C:\Users\Admin\AppData\Local\ykPUYuH\GitHubDesktop.exe
C:\Users\Admin\AppData\Local\ykPUYuH\GitHubDesktop.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Users\Admin\AppData\Local\ykPUYuH\GitHubDesktop.exe
  "C:\Users\Admin\AppData\Local\ykPUYuH\GitHubDesktop.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2004,i,16058333920385059227,15499043098089756107,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3180
- C:\Users\Admin\AppData\Local\ykPUYuH\GitHubDesktop.exe
  "C:\Users\Admin\AppData\Local\ykPUYuH\GitHubDesktop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --field-trial-handle=2004,i,16058333920385059227,15499043098089756107,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2032 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:4968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a4316.rbs

Path C:\Config.Msi\e5a4316.rbs
Size 9KB
SHA256 31a90678bc1b167f246e53d90d42829181bde50393e25fa22ca7bba0c1c80cb5
MD5 98305cf35eb98b45f40976d27b4ebd1e
SHA1 de39912be61322028fe84b5264ed93f8d6589798
SHA512 badf7e858371218f3c5cb619b6800c82ffb388b5eb2d52329abd5a4a61b76dba992153646cc3d1972cdc7a4340beb1845278b966420a3287cb86787c8a96e534
SSDEEP 96:cwKzFkjhwiada2kwIRsfVXhaHXt2I921BCQDwfUr/Jz6CsThqWXUr/Jz6C6jeUV7:cL+wV3FCfMBpIgBpmcMS6pr
TLSH
T138125540ABA586D2D49D173BCB0B1B853776E2FED311530E098D93251F93B9CAE8D287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34d711c4-b526-4607-ba22-11bc03c365de.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\34d711c4-b526-4607-ba22-11bc03c365de.tmp
Size 5KB
SHA256 5571a0d4e8fcd99130e89467448f982380bb46772738b767e8e335ac9f8555e4
MD5 74a6c3c270e0e3a5f6b110d330537554
SHA1 a0a2a184da1b5186869ed33f1bed39b522e4e0ba
SHA512 49e11910321c561b7a7d3a2639599aec35a85bb626c7f66944ce1e1bb50ef11c01ddce10faac95b4b06246cd7015fa083453be851a119b1b25c262736309fd78
SSDEEP 96:kbJ6DEjd+OI4Q2k7i/jfTVZ9ZTFSl8h4otop56sZjDXB6/zGyvX1f1I0jKHDIyhz:ktU0G4DkG/FZ9piU2FXRGacfm1DIyhuu
TLSH
T1DAC10931A8BDA9B26AB2E159F1433D43CDB4915F5605AE24DED84F0C01E79DD2346522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8d8446ea70a4091f4e19f38c0d917a0d6b02068bb467235485c0cf42e0abe4c7
MD5 36babdb6527072e3c8ab7c42f4df9160
SHA1 5d052430368836359ff75e226206b7e2c50a67b8
SHA512 9b6652b5242f8be0d5c20323a5d4b73aaecf78547a246c35dedc07625dda810499fbd85442c8e4261a9e49c48f738ab22759f4c457d3734fdfcb01b704214315
SSDEEP 192:BRAn+lVWv7MvAPRp279gHsb+WNnaR0OC+Ds7VyIsnAUgR:BRAn+iQ6Xcqwo0JdR
TLSH
T1BC32D72EB915787B6DDBE21AFE627B43D7F6106721952E84D6FC892C18E79CC2213007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b07b5bedf7aef186ed3a0362ea025e695ed21d79a55e702cecf655aef62da702
MD5 3c7060e1f0099311a913dba527a27745
SHA1 7bd0332c425951432e290ebb3acf0f760e00e971
SHA512 30faca0d170acf732314cd8cb15feaa4a9732acf8eff35d3168f08e8f186dd6a92a81d6d67f2a7f53c5d1257aaf800282b9db9f652a87317a3c2ccd4cda4c762
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN9mjIAl53Ii:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCx
TLSH
T15F32E827A44D9A7B0FD8E44DDC126F8B6DF5419272780D2893FB9C0803A97CE115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c87d8f5c0ada8214fc5d63605981a9e57ef28a9e793430b3c785a06274dadc06
MD5 31e05d7c486427ada0100d8c86529593
SHA1 13e83e62f473a9ffef7dcefd433b427ca14de369
SHA512 b76b36c165fcb29bb1b40a2dd2556c6a907dbc0c4cbd4eea28b4a64b838ccf41476285678e02b2cfc0d71a8c71e6dcf85fbaac4241257595dd7a9b43af595085
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e3c8dec793e857753b452046201697d9025064408635cf78d42a67f507761566
MD5 ded1de91fc131cc4ab09d3adb12b7c66
SHA1 487af6185a5d2ca00168d66883cbc01e6b7bb6a6
SHA512 18788d6d540d74de3c40f73efda9a526ccfef1bcde4e1fc1d86352d0b4d7d072d04026f08a440d40ad5ab0efcf394ff182fdea6388f0c852291e7dd1776b6798
TLSH
T138A0025262E38451FE12DFB1A2E10A7D2291C82415D1C7076BE28865A9DFAD5554D510
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 abcc6e18949d1b7fbfb5c037cb645e5e06f23c5edc44544af6ec42b835f61594
MD5 1d949786fc7616de39f419e952038cc5
SHA1 8f9c5084a06578e690e011726cfe864094a6f146
SHA512 5656e3ead594fb31500186fe12114881d92ad29c70744a11e4c071f0b36b9d5971e384e42a5380f2a74b83c3e4d4061e677f721e1d6ea247d4d5c8561e65f756
SSDEEP 96:kC0d+OI4Q2k7i/jfTVZ9ZTFSl8h4otop56sZjDXB6/zGyvX1f1I0jKHDIyhuL0jL:kC0G4DkG/FZ9piU2FXRGacfm1DIyhuLy
TLSH
T1A8C11A71A8BDE9B75AB2A159F1832D43CDB4515FA600AE24DEDC0F0C01E79ED2342522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 fb9e5c490b0b59dc594ca25bf4f55dea91a1e18a931565b4b7e25a0b8ee8c2ca
MD5 1d9f7c66588341020db5f652994f997f
SHA1 c5f3dfc16651bcbb7b4d53525394178377401a54
SHA512 d70e4ead10c62c0a91988d5e4d1ddae2edcd86e1531267cebe21fd44161b21e390bfa297f2f357d1b45e590744dc588c77b88bb5ddee95e14710aa72e76571f4
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok56s6DXB6gGyvXNQurbfyYv4a:RC0G4DkG/FZ9kGDUD4RMAQurbfX
TLSH
T1EBA10771A47D9EF75972D448F5923A03CEA4A0ABA611BF54DEDC0E0C11FB1ED1342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45B8EB4.tmp

Path C:\Users\Admin\AppData\Local\Temp\45B8EB4.tmp
Size 4.7MB
SHA256 7b35aab8ee68a19a822da08f80dee062f987cff5a74d40437d77aa62e3f96d1a
MD5 ffde21dfca5e3dd1ad3a872d40da2490
SHA1 cd2c20a6109de3f84b55c6c2fe8c2d7fdb429666
SHA512 be5f01d8c0bbb9024ca3acc9d02f89c61258ff7a02053a09ccd4dd31daaec0376ff343c367b86b10c4f24207ed880cdabd2e2eb3c26e28a5a3b00c6e2e744002
SSDEEP 98304:JET/Z7lyBrn418LJwlkzCo1lfU6oakl7ag2bcp8Olkber:JETh7YBrZVw0poGzNpb0
TLSH
T1D8363336ECAF2B9E95E4DA173E40C4D1F87C12BB2E0D095E2309149D94A9BC95E633F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45B8EB4.tmp

Path C:\Users\Admin\AppData\Local\Temp\45B8EB4.tmp
Size 4.7MB
SHA256 c0eeac2231f738875450380b766f0b3e8f250610b9177da5657f4f0a78f96f59
MD5 ca3bb3cf7b060aff17c36caff93d5e8d
SHA1 e2769e8d5b9f7465e38af0907a02cb266d444937
SHA512 8fd86ac3310b662150c1e67703652bea1b99123b12eb9d18c443a7f5dc39f8dafed4fc899e513211375a1a9d1c79926598ae0b1c8df165f81b6b528addaacadd
SSDEEP 98304:MET/ZGlyBrn418LJwlkzCo1lfU6oakl7ag2bcp8Olkber:METhGYBrZVw0poGzNpb0
TLSH
T191363336ECAF2B9E95E4DA173E40C4D1F87C12BB2E0D095E2309149D94A9BC95E633F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8C0BCCB.tmp

Path C:\Users\Admin\AppData\Local\Temp\8C0BCCB.tmp
Size 40B
SHA256 d758ba9a649562e7f791645d42629528f33acc393cfe86470147203dcd8f7c56
MD5 bebc33af482b9faceca963728aaf8298
SHA1 cd692d03e82cda9603b0688333d8fda0d6da8a7c
SHA512 8133a5564a7760660a236cff7ba6aada378cd68af663ccd11cca13a6e7e8eefdda385239f819496b09a2bb9e74de8fd7b7421e824b8ef82ae1ad0ff876675e5a
MD5 SHA1 SHA512

Submit Download

rV56.7z

Path C:\Users\Admin\AppData\Local\Temp\rV56.7z
Size 18KB
SHA256 3971502b07da07deb2a725dfd8a904ab791f0652542f2747fa4a8454facb98c5
MD5 18dae5498c13751acc404bfc516e157d
SHA1 bc435fb384048223cf7c897a586d868508a5c09a
SHA512 c681a87913bd8460713c58b3da8b3cd876b14c980d1bcd58509ed04dd1d8c35a4f7edca0e17b9ae725787302d5e5aaf10585f184e7a4e3f23e583004f4ce72f9
SSDEEP 384:LKrxiJBF5/j8XEYVxkIJuQaEMKI9lK/55PxoJcZ64ZFs6sYn:CUb/j8XEYTnwZ3K/59xecZ64ZF7ss
TLSH
T13282E1D381AB5966D20310965F57F98B50A6BB50CC8010BDFDDE7282D074274AE2A8EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3936_2107423761\CRX_INSTALL\_locales\en_GB\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Wallaroo\MSVCP140.dll
Size 554KB
SHA256 9b783a58b3e1cd9976169f3ca9329f868b7980966d34a84274c2208a64f8b6fb
MD5 53a6dd2062e438cfdfc3327cd48e9a43
SHA1 02f7cb32c424d06fab1937ce0203952fe0f558e6
SHA512 d24d58d940e7b77bdd36dfc1b601eed9355f9d9560152196754dbb9c1ce3276646003b23af34274b971b87c39da1681f3b1e6f81721b81c68441a12895cb9825
SSDEEP 12288:D0+cOjCI4JxkdGwm9b39KJ7TgQSToGet+VfTxZ5HU/Z8y8RQEKZm+jWodEEV8q:A+cJjxzH68RQEKZm+jWodEEuq
TLSH
T131C40927774902A0E195A3B8A1C34305D7F07C5A8323A3C792FAD6AD2F5B7D5673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Gaming.Telemetry.Win32.dll

Path C:\Users\Admin\AppData\Local\Wallaroo\Microsoft.Gaming.Telemetry.Win32.dll
Size 309KB
SHA256 90e199fd0a598f6bee2beb413a51f4d517e5bc5fdc56ab84a6164bcc1d640fc7
MD5 963957c275debcad07fc2a69705a9234
SHA1 db0402a5379a66752df038cca4d9dba19f3b6322
SHA512 255fadd0e90ff23fd93bcd1b11031449a9ae440df6c05204355ac9f1f0a33a3374617d2a04dd7de081bc577cb2e42bc61d16e2f4432db414a690184f2d34e664
SSDEEP 3072:T6Q8e540cSDXqs0x9mc90vMhrh7ZY2gURdag4e3ucgHYZFOJ7knXsLafmqZaTr62:mQ/4U+x9mTMhRZJ1daLe1OlsKTr6Bmx
TLSH
T1D7647C16F3A504B9E477827DC9938906F7F278560722DBDF03D4821A2F2B7A0697E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Module_Nan.exe

Path C:\Users\Admin\AppData\Local\Wallaroo\Module_Nan.exe
Size 520KB
SHA256 b14f96a7a801b977b23ec6eb626c4ccdd723d9fc583d1a3d0e6856ffe8245fab
MD5 f05a3468ad245747c23e25d7d65d6864
SHA1 2b921dd3101067aaee3c566b14976405e027d7c5
SHA512 a5becc89106759776192ab37b96fcdccf6de02e14c2ddd7f1f2dec6f5ab834c4eb215a2a7b8aad9cf5854704bc6de5b90e57a1f1f512eefecf9090c7ac97eb8e
SSDEEP 6144:Jm67PPPCk8PC/hW9pSo2izd3zB0EjHaxXJ:o67P3CRCOpSRiLHax5
TLSH
T1F5B41851F3AD56D7E8BF5A359922C451AA737C220710C2BF125233EA2D33E419E7AE07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Wallaroo\VCRUNTIME140.dll
Size 94KB
SHA256 3ae20038f198472c5fca87559cb1d462632eeb93903f8c857dfa0e3f6a85965a
MD5 bd3549bccc629a06740fbc35d4e96fa8
SHA1 4effe52539405c86484df63f684c90487fac6db4
SHA512 91a7f43d5be995c0d1daed597b1b0041f18561cc24eddfde58726edab5917adc9eb304f049db1aea1bad2e37b274b8babc13579179704cd91cf32e316f84ae7a
SSDEEP 1536:az1Nk4XCDPg1Z/Q4m32oUFEEOw9HSflKnZqjiD/ZycecbyWusc:aZNPy3rUiuSfle2iDRecbyn
TLSH
T135936C4A76B482BBD46AD178C2E35A16F770B840877053CF07B686AA5F63BE05E3D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

context1024.toml

Path C:\Users\Admin\AppData\Local\Wallaroo\context1024.toml
Size 30KB
SHA256 07a7f0329a69e6bbae9cf9aa3674f27a39711f27f1eb25d7ebd8d1417286d2cc
MD5 39dd7de716307daf102990dd933a5e2e
SHA1 667043565eddb045ba37d48e1301b3467a25a097
SHA512 fce0f8fd1d2d35f998b95e3c0a8667ec0d35a436b3091ed46e98a35bc909f7aacc6e3a3ee87277bac4988fe38d3e87c60aa58d7d90e9d419653ad71c80b41f6d
SSDEEP 768:dZDQtDunzDzXDh/sbXAu4fzrFWTzxviEjp9EcLZUUpgi:dNQl0fXh/sbXhhTzxK+9ESh9
TLSH
T14EE28DDBD72217A7FC0A7C95C91890A38B45FC3CEE5E4EE0BA9154B5B8394B4C924C87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventspec37.lib

Path C:\Users\Admin\AppData\Local\Wallaroo\eventspec37.lib
Size 4.3MB
SHA256 1ac5415090fd6fb512dd31b6034996fc2c7908a13445146f87e7f60f73f21310
MD5 adde822b74af518b83694ebe104471da
SHA1 cbda3dfd52838ddcb0a6dce924acdabd14e1bffd
SHA512 aba91c3c7dad1c244d3c5f843a8ec99cc298d4edf9516dbbcb0422fc91cfd7bbc54042d465244ddaf232fd396089ed001239954b93fe3c2dafb5587f8c485170
SSDEEP 98304:hOvFKWYAzrkgQA4zlNRbZiUhpNlZMUsphbFCG43FoDpZGjyLY00ITlDG+pKzUrPp:h2oWZGlNtT7MfLYTViGc0ITF9HPp
TLSH
T12B2623BA94D540ACDC679F7CF8F814750792240BD1389866AEF3C49A9AAC3DCD634F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpvis.DLL

Path C:\Users\Admin\AppData\Local\Wallaroo\mpvis.DLL
Size 182KB
SHA256 e6c4979b7a8bdef6922f67d79fb6d59d543e40f8a6d48bde42919a210e378c7d
MD5 e24f27f422f4a45cc9e6ad14168c6041
SHA1 bd448f5fe112833380dbe60165ed25e7bd7e3299
SHA512 6bb9b167c686634d55168627313a2e637329977ea8773a26810c7f53ebea18543c69c255e635b90cecbb2720023e564c06706282e184136675d7f76400c289a8
SSDEEP 3072:qG3nLkum2rpKRQloNlF0LgsqrOGefu2GhFu5TtjttEb:F3oum2rpKRgo3Fsh8mA
TLSH
T19504D5853268C0E5D025B23A91979677B6727C82CF6206CB3AE81E6C7F77EC06D36351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Wallaroo\msvcp_win.dll
Size 626KB
SHA256 e1a99ac49449ef7fcf07ee571553870f3c7bb8b3fdad97ea93276987ecff0333
MD5 bc127f7392bd82f2937ec7d4eed0c5af
SHA1 b7b0b15ab99b1d14802251d43c0f4e59b5d27ce7
SHA512 1f45664867c05ccde52e13cda262d0f2a90928175cf9477bbd9f2dc8cd9db79323a54dc81d7ffb07ab51c2febfaa557f110c613aa20f57688d055e2fd566381d
SSDEEP 12288:O+TTIwt0B5483RXXoTk4iQKQEKZm+jWodEEVUsS8hx:f8wdKnIkPQEKZm+jWodEEmsSS
TLSH
T137D41827BB5906A1D16693BCA5C74306E3F1BC154721A3C742EBE26D2F2B7C8673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Wallaroo\ucrtbase.dll
Size 1.3MB
SHA256 db6bc090827c93a24ed59bd73a6889f99b284c59e9abc9ad8bf1985d0b6ad14d
MD5 40ddc069a568ecb3f9db9e8a439278be
SHA1 8e4c5187915e3c224e6e9e2e33ff1de1ba8b947b
SHA512 451ac7db53dfbcfc31ed9bccb754eb7066c114de88b752af72c0aae4a0430eaf6eadb2fb66e54cd7564d151cea4af413fa3d5e996a1ab311608b9190832cafdd
SSDEEP 24576:HM6VUOfZDUVOb+uifkfEee3siuEWBlwmN1v2PI/BoEzJszZ7ymxvSZX0ypOpT+R:HM622DUVOb+uiMfE+nzTv2Apvz4VpQ
TLSH
T17055BE6576AD01E9C1BFD139C64B4A06E5B27C1503708ACB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Wallaroo\vcruntime140_1.dll
Size 36KB
SHA256 c2c9eddf2e847c0b9b32b14e3c7175bb4e75953f60556583bcc0f78d607137bf
MD5 39060b10e3364cda2ae9eb3d45cfce2d
SHA1 2311677387722fd9b3c46c037a08261325145af1
SHA512 9577fb523f4e7fb0ca59a8cdf0ff356a53d269f8806066cf2e56044e2ab20940d0598067884fc7b8c97acbb59ff637ba2089705f07aaf06f906e001fe3df3bef
SSDEEP 768:pko+mEMDEFXgxL/aiRZooSuU9g17I6Zz:pWxwvoohl17TZz
TLSH
T1C9F23994677C4092E46B95B4C4D3AF27FB38F8615760A38F0AA5825D2E237D0F63E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\ykPUYuH\chrome_100_percent.pak
Size 112KB
SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
MD5 129f8cee761c5bb414b2270356177f6c
SHA1 0a10b55daf24c7f9fff1b22f853dd87a98433b7d
SHA512 33f4ceb0ed18b2172e2f6d203ccab2954dd900592b2e62ce4a1019ab9404889ebdcf462a2479f1847c01b2835473e83859c77816e83ef76ee133990be3d55eb4
SSDEEP 3072:DS4PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:LYWFUbGz8LI1TnjQBQCrC
TLSH
T136B3D0D7B3B09D7DDA460BB783560170FCB31B2D06C2120A5A9AE479652BF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\ykPUYuH\chrome_200_percent.pak
Size 182KB
SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
MD5 ed7b4e5eb15a086ce7e117a3228e3f15
SHA1 bb6debc27ed4e2f20149a17e36a24ef4482a96a7
SHA512 7278e0acdd8a1806bbdfd147d5439f7f849fbf95f1be1ffb741ea84cecad2557469e99f91cca66ce36349a9aa55d0107e34b9499b8fcb3e7fb3a8bbf84c1e911
SSDEEP 3072:CJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:7GQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T1EB04F1D723B8AD3DD9570B73926610E0FE7A20291EB3110A5A9FD8397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\ykPUYuH\dxcompiler.dll
Size 24.5MB
SHA256 45e3b84e49bba7026209b3a26fef7f2ed3ad7b04f9d7b9b126dacc90cba564b0
MD5 d6e87b513a1b0afaccb5bff53a23481d
SHA1 cf20254671e659d79960da4db2e5dd47e9b05e30
SHA512 60cc3efcece0b8637b57876fc479825aa28e088817729de0c6676f2074cb8c9a453b5b0904d0f4d8cd1c6e9be76174704a9944374ac8ba58e8bdf9a1b5a0968c
SSDEEP 196608:6sq7jjh1u1/1i9iJj24AD14c9TR8Z6GmfozCEJdXqaq:6sq7jjh1u1/Dxc14e8Z6GmfyFqa
TLSH
T18D4729122646D49DC059C879C7678B268A6C30E73FA7B8EBC0F451252B79EFC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\ykPUYuH\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\ykPUYuH\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\ykPUYuH\libegl.dll
Size 517KB
SHA256 24c40226ad08f54feeefebe5ea9c17bceed88f876c70077907e42496fd13c8c9
MD5 d6b370c509ff19ee4f5ac5ba5a9db55b
SHA1 59b596cb154b55a46fb0625432fdcbef299fbfd6
SHA512 a98b40f645429545249874c3538321d9e2efb82477ef87e8c0352e053e1b1592b55ecc4b99c8919c20c05791721ac8340cbd6bfcfa612a01de225fd1bc4f436b
SSDEEP 6144:wQ4VIVcVQMLMVwCtKpDaLnjSFeN+a+BAiLm4LiE0z0WhcEuvBLPdvtYPqQaQC:wn0iCZjF+CymG0z0WhcEuvRltYM
TLSH
T1B1B48D15F3E847A9E07AD0348A438642EB7574960B65F9DF02E052792F3BBE45B3E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\ykPUYuH\libglesv2.dll
Size 7.7MB
SHA256 50e9e27e08ee076adcdcce008f4934ae63b7ab8ab09369eadf0183b23b542ea3
MD5 be921a480661d3aae95beb561c110505
SHA1 a74d8717fa47b704c14ca0c9fa951947836ae9c8
SHA512 30e8313ef5249194b0cb1999a9468e33020fee9c79e57c7b3a41c404d80cd211ea94ca3ac3abbe1abe66289373cf71d3d594830fc5d88260d3679309f02a0375
SSDEEP 49152:3upJ61ZvUdnnnzCwAOqBmONJAbLfkcO0VsWkgp9rnnG45/ifbKnNdCusheIYklbG:oeCXaoJl9aWNd5JIBhhpJK1Ixe2l4N
TLSH
T170867B03F69681D9C05DE278875BA623FA34B8450724B7CF2A9453162F66FE0EB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\ykPUYuH\locales\it.pak
Size 635KB
SHA256 22fdad4c81455285e41d96f8b4268c84aa1bf4758f87767eaeaf627af85ec9d0
MD5 3ccd6cef21bd38dcc92e526fe478e277
SHA1 480d177429c0a745dd3f00dd6cf967d9f0b9bc78
SHA512 077f30f8c6ab3995fdb57e4969feff62f8c8f962ad9e6a299cc9fc2eb62efcd1a0bb99e1f08681997cc7c9476837de271bdbadc3ad980e9ed450a81b21235861
SSDEEP 6144:8/gYPmju7DPOmiX9/y52N5azVd2sYSfqBCfYs61wtn/RT9TbhOKa1iTURWYrCdqJ:8/LueDP9dZZ5z8tN8DfUWPqljVN
TLSH
T1FBD41B3AA9D6212519976359E611F085FB6EFCDCFA417218C99B031C22CFE80F1ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources.pak
Size 6.1MB
SHA256 ce5c35017fd7aa648fe44381711cbf42eff5f6923b11241a4789058dbc5b27aa
MD5 79762f4295600653dca20bbaffeed153
SHA1 85b8ab7d9e7fa663dca0babd1f72c79a1f39d99f
SHA512 13784fda38785e3dc23b118969478c61040e81e1271f6ca7d7536ae60872b1adc9f2a99e15fc17e5c4903046eee8508b686fa18092cfdbd1c0a29b79fbf18484
SSDEEP 98304:5vjQ8HDIPJ132R3lW4uKXegybAHltND8rwri0J/xUaAUXLPC1GP4kFbG:JB0BRulFzPtND8kri0JlAYz4kFi
TLSH
T1985633E1B7A06CAFC5484379D19542343A3ED95F2581739A188CB33CED6D91EEA4823F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emnapi.d.mts

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\copilot\sharp\node_modules\@emnapi\runtime\dist\emnapi.d.mts
Size 20KB
SHA256 f90f1a5f0f3ea1a89ac20df273bbb5827179770f6b7dff7675c24c22d5d06054
MD5 4557f4a5bf724c282da9e8b183e267dc
SHA1 d17b722dc5ba08629f516392046de32b530cc76d
SHA512 2fe5b6488093e6c06f3d43caf3653753d07b7d07b3ad10aeb94ca7a2e34457168d7d5b8fba594e1f4fe82a0de17bbff3aafb622927dcab227da61cf10d120be7
SSDEEP 384:tZCSRUphfxnD1GUssTAgVEXt1vNSoaeAEVhBvWVoD4JOswb:tlRUphdD1GbCAwInuo1
TLSH
T161A27546FD62B02925B0D69797366347CD0440776F0858E172F9221C3F798E8E2B2BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emnapi.mjs

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\copilot\sharp\node_modules\@emnapi\runtime\dist\emnapi.mjs
Size 40KB
SHA256 8a25d7ff3096fe7fdb3ed707ad4865263d4a5fa4440390f56c41ca6ea34e66cd
MD5 d2ec5c651377d426e2bdaf3017165ebc
SHA1 5bf99b9015268b3c994ea7d4a9c1530e59c13c74
SHA512 16dc2114008e8a94af6a7655e0181f02e7507f0c6d5fdf698c1445a3b959377ddeabcdb3d68362396e143eba6ed7dc91becfa4f8f77730c1964c684acd5b1db1
SSDEEP 768:yF1XvN3JVaW2lbQVx+dLAApEdelr4kOYh9wDvmnF4CF6q:p6eDOYHJ4CP
TLSH
T195033F9D2AFB401181A3B1B90E3F6146F135D81B250ECD98BE9C82C4AF54574D7E1FBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca-bundle.crt

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\git\mingw64\etc\ssl\certs\ca-bundle.crt
Size 223KB
SHA256 3e68a959493625de324485c7e0314e68688af96b6efdfd80fb7f99e804493459
MD5 980110a93bd5b93b90e58e1be133279b
SHA1 aaad3ce2d993f08adb69a5584e746c9431c13e4f
SHA512 7f10d19c405ebf8dd2dbe16262f271398d9d161d06446131bd5526007fa441a3ea8e0d987c22782f3693182cce3baf7a4a15356f4f4e6ffcdaa51fbdab5eccd7
SSDEEP 3072:QeUwSJhyIb0GDRVwRwewJJghnVpsd44Sv/doJ8IUefxQ7oIvdtX6vCfvnwVeoTan:QtwS/8Vm4JBQeofGBimhnuxOXGseZbv2
TLSH
T16624AFEACF913C4A28F3F090C9EB126AC9195362ADDAB0B31D593805C78976D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_log_list.cnf.dist

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\git\mingw64\etc\ssl\ct_log_list.cnf.dist
Size 412B
SHA256 f1c1803d13d1d0b755b13b23c28bd4e20e07baf9f2b744c9337ba5866aa0ec3b
MD5 5b561a90362b8eb9127c792c3f5902e0
SHA1 a2587c4e97408b64274e5e052b74e3754892c13a
SHA512 ce307f87b90e0a0d09335577283ab4509802b43d14725d76c65139f6625f7e4fe636f41c9c398ccc9a2c70b229a34fd796b8ae0e9f5f3720e43f727a60232167
TLSH
T123E0AB8AF88C24BE27648599319A24B5F60EF19E741749B771C941492383F35C5D4683
MD5 SHA1 SHA512 TLSH

Submit Download

tsget.pl

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\git\mingw64\etc\ssl\misc\tsget.pl
Size 6KB
SHA256 6146f32d624f28f5e9edd2c7b7388cd08c6ad9f5d5723e7d06a7000005525550
MD5 85336edf65acf33a051ff06425ce72e5
SHA1 a57b7a9f00d25e0908a81885a77ef89b545c55e0
SHA512 0e6298e62094a085aeddb81e9455d0e27678b0bea171891ca250d6b625fe0d9724bbb3c23b8b932f82937dbe7b78730bf5ea6a68b87afb22d35b9a7a483ff337
SSDEEP 192:3c8QjxPB2QAcz+b1/2HzoiQEXl8v4G4qm:3cTVuboHz8v4Z
TLSH
T1CAD134093C47220796B3E0E817DE9449E93AD94773ACF969B9CC86C41F1142DFAFD0A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openssl.cnf.dist

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\git\mingw64\etc\ssl\openssl.cnf.dist
Size 12KB
SHA256 a65a2cb9f4ee8ffdc7ef4f0ac600c0bdafb95b7b1ab457188ac610a62f5ad6b3
MD5 bfdc30bd205b6ca2c15a46b17721c6f2
SHA1 5ff8070dceaa742043d8171f98abe95e5abd02e5
SHA512 626e074bb93e4c2efb8ae81510ddf5418cac1ddf39e28b947ffdab3c16378aa7d9061d6e88d7f7a4828372e74e1425b23a0556643aed265dec85cc949eead715
SSDEEP 192:HY859fPVjOTrsTBZNtmMpr/kWJGXgvr/YVMLgsmgnWFo8hsmgtHMLlEp83ezmB2F:4Qh2sTTpr/kCGwvr/YVCbfVhsO4G2dL4
TLSH
T18342E71B978AAE258B4323B1B643D191EA3C266E7F633C6094DD81CE230795093775DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvimdiff

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\git\mingw64\libexec\git-core\mergetools\nvimdiff
Size 29B
SHA256 bc1d96063154a0e5a7f55f5f3579d275c124e84ba33eb50db2f5802e259b479f
MD5 bdd9fc39701396aaf483db1d69c74f83
SHA1 8d9b8962cf46ad994c1caf2f6fdd58c893096d8b
SHA512 666ceabd5fd66af8905678eb481a2370d29ba2ee8cf0220e4b63893c85027701e7f602dad3ca00b3d203d4f934f381f186798d6cbc7a604ad2ff50c9d673468c
MD5 SHA1 SHA512

Submit Download

COPYING.LIB

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\git\mingw64\share\licenses\gettext-runtime\libasprintf\COPYING.LIB
Size 25KB
SHA256 20e50fe7aae3e56378ebf0417d9de904f55a0e61e4df315333e632a4d3555d95
MD5 4bf661c1e3793e55c8d1051bc5e0ae21
SHA1 714f44a04b7807f4207e645d57aa73240e7e5d69
SHA512 e7e968ad0983d03f6bea8b35de580ce6d717fd4ade95e32ed26807d8ae89631c0f188a7a18f9eefba9a2eba46c31aa8b1f2aaa56621dea1df5140919b441ba39
SSDEEP 384:LY56OuAbnn0UReX6wFDVxnFw7xqsvzt+z/k8E9HinIhFkspcM9bc7ups0CZuQd:LY5trLeDnFMz1ReScmc7GshZuQd
TLSH
T160C2953EB70113B206C206915A0FA4DFE32BD07932675A64749DC15D23AB83553FBBEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COPYING

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\git\mingw64\share\licenses\libiconv\COPYING
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RUNTIME.LIBRARY.EXCEPTION

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\git\usr\share\licenses\gcc-libs\RUNTIME.LIBRARY.EXCEPTION
Size 3KB
SHA256 9d6b43ce4d8de0c878bf16b54d8e7a10d9bd42b75178153e3af6a815bdc90f74
MD5 fe60d87048567d4fe8c8a0ed2448bcc8
SHA1 c0ad296b24f96e7c77ce564cad2fa1a4f76024d8
SHA512 0fa9cdd317b02a5706dbb619231dde8ad843f4052dbf2c8daef97fdaeec81af413be12faec4d3bfba583e77604596b5aab62f1c9d54758dd32358aaa9bebef5a
TLSH
T1E8617535A18C2BB205C303F3371E25DAA7B984646B678591686CC19D3782C35937B7FB
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\git\usr\share\licenses\libopenssl\LICENSE.txt
Size 9KB
SHA256 7d5450cb2d142651b8afa315b5f238efc805dad827d91ba367d8516bc9d49e7a
MD5 c75985e733726beaba57bc5253e96d04
SHA1 c5c8a68f4b80929b3e66f054f37bb9e16078847f
SHA512 07bdeb77b6ebe1f18ba5285d98a05ac53502a82837118e194d81384bbb9c1a8e7bb7ba627df288c770e9e97599e24a5135e45546cbf493330773c6b9921ff5b6
SSDEEP 192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:UIvlKM1zJlFvmNz5VrZ
TLSH
T19722512FBB48037B06C20162A79764CBF31E903F3B552568314CD1681F6B96593FB6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\git\usr\share\licenses\zlib\LICENSE
Size 1002B
SHA256 845efc77857d485d91fb3e0b884aaa929368c717ae8186b66fe1ed2495753243
MD5 b51a40671bc46e961c0498897742c0b8
SHA1 233f44af3fb55dcc7fddfef8e77ac627b0008756
SHA512 b2401af44195a0409091e5b1849c5f8e75f49987b2d9d1cefe043a34bc138596824e91f112de0409d3c69b4bb21cb37c9bc84fe5a566565bef884c846a3d4011
TLSH
T13711CE1B7799937125E646FD39D68DC073176E64B34E42D870AD808837AB26112344A4
MD5 SHA1 SHA512 TLSH

Submit Download

openssl.cnf.dist

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\git\usr\ssl\openssl.cnf.dist
Size 12KB
SHA256 e4c87d84d4650c39a0163544a4107842b2ca42487cb61ba570b03b011275d6c3
MD5 08e03ca385ae27e0fea8ae3145f3e61a
SHA1 80e63f72799ef0175120a2559cbdfc0b053d0068
SHA512 0c48457a9be55aabe0ea0ef80bba41d91e4a04b82868e5d51801786ab923df2c780b301e9f3c4f0972716b41b14e96281472534cf61ea0c3501906bf568579f2
SSDEEP 192:HY859fPVjOTrsTBhNtmMpr/kWJGXgvr/YVMLgsmgnWFo8hsmgtHMDlEp83ezmB2F:4Qh2sTrpr/kCGwvr/YVCbfVhsG4G2dL4
TLSH
T10642D61B968AAE258B4323B1B643D191EA3C256E7F633C6094ED81CE230795093775DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.js

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\main.js
Size 647KB
SHA256 2932fa61bc885147107ec4c9ca7cc64052f0abb526ee201b87f6fe8921b9b1dc
MD5 d82373f5ea07b423f4903f9a9c7e28c0
SHA1 4f3caf59a5d97831dbf6a068e452f64fcd814008
SHA512 0b25f5b7f35253ef5adfa17e93f6953374179892d253a994cd686111078712df57e3807633786a1f74310f808575f3cf8321e7f34c299f466287ab6a10564168
SSDEEP 6144:FrH69m0RX10lV3c5SiENV6pzqqUfM8953FEqtFLwicNOTKV9sb5RLMYooYyRwgI7:FW9snsohN2zqqUfPFtLLwivTMoPtK
TLSH
T14DE4E7C877D5BB60828164B9113F710BA479DC593808D0DCEBE5D9DBBC7831AB876A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\package.json
Size 452B
SHA256 33d899b27acb9e16ebb9496ce53b3d738f17667b45145d39e6b34de60762172d
MD5 dec7896f3a28b003b85cf6b8f7e37ee0
SHA1 726a96a4e007ab3fc70f4b4ea252d2590f71d035
SHA512 42cb1bb7f0f5ff371aa79783a109fb6543b73513b0056a7697eab82f6e8142584c6cc414148df1aa3c87e354a20af0f27fb7b09cb4ea60b6637ada4c6bde0eeb
TLSH
T18FF027CF4D38687D0F3116D0E9AFAC4AC7391E4084E89C08C1EB6528807C55A538D92D
MD5 SHA1 SHA512 TLSH

Submit Download

Fortran.gitignore

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\static\gitignore\Fortran.gitignore
Size 302B
SHA256 54744de08abd9aa72d15c0a7043614010bde0f1d51a60bfbc606bd5deb92c1a3
MD5 db25710e4fe3fd4918ec278317835754
SHA1 ac6570eb9e37f7c8549833e892ca51ad4e340d57
SHA512 f535e0581a0b7705454085e24fac549a15159f121eab4e2b4089f5878d4ab1b1f6bd18eff2ac016e305651f4b75fa25ee93149a1604c7ac5600d20ebbbe9bd50
TLSH
T196E08CB8856F7CC168A326E65B78697E5392C5406B0183F1BD8F029B2562CA8138447D
MD5 SHA1 SHA512 TLSH

Submit Download

Octave.gitignore

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\static\gitignore\Global\Octave.gitignore
Size 477B
SHA256 49026a65272118492855b969ef406f0b57ce68c46064aed862d306f23ede2ef4
MD5 2ad867b97f785ad0472033d7b9426739
SHA1 0ca078fc05c12cdf3bb64ea54acfa1b7daee6e4a
SHA512 c1869eb00c75cc17122c470bdb3a287841d85691a04e6517959c82b772acd0a7af9d87bfc26233e0a496c03fd9ee396ea3a78757468bf60cfca5fb7a3628d502
TLSH
T119F027A2706FF623143E80D69966413E9B3AA854A182E0B478AF9109F642D9803762ED
MD5 SHA1 SHA512 TLSH

Submit Download

Leiningen.gitignore

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\static\gitignore\Leiningen.gitignore
Size 171B
SHA256 be32c9e79fda8949497789af423f6845b072a84d5141629b1a36b099b8d3fa1f
MD5 62bbc0e35777b7ad468797398bc5f6d9
SHA1 87e7c9dadb86a7917c9ef0579815765cac196bbc
SHA512 1a0ac12d822a213cf0f7927f68e66aaf308edc0899f844806e84ac08d67dd24b169a7af7746ad89886dfe66b19abf16be0ec57cd254eef058f238ce74d4ddce4
TLSH
T101C08C05420C0773D74FF00004F442033AF9E39C2A030A6035EC388F9E2499C77B7540
MD5 SHA1 SHA512 TLSH

Submit Download

release-note-header-left.svg

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\static\release-note-header-left.svg
Size 29KB
SHA256 97eb11b78a22a8427213d90b9dcf6cf95048effaf8827a00019976b3dc5cc86e
MD5 5366b1eb6fd9593646395e7fef068215
SHA1 1ca6d094ddcb6287df34b22408d02427428aad56
SHA512 af5328e8fdb7edbccad5a12eed94db64149f6fd8fab4a7e290dde03f6a37e5846fa917995880b0ba1fddc257c7930ef75ce826b1892b1edabf49b6a3d18402fa
SSDEEP 768:suvXMqWxjt8EzfofYbQEHuLPX/wyV7J9x5H:tMqGjtHfQsQ1L7fn
TLSH
T1D8D228D52302CBF1F4090FEEA512242575452CFB7F31A1AC88DEF9557E224E88A798E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release-note-header-right.svg

Path C:\Users\Admin\AppData\Local\ykPUYuH\resources\app\static\release-note-header-right.svg
Size 8KB
SHA256 35e25beb4b4119d69db2a54ccb152e8a33d5e1873dad308c7489e79f955ccfcd
MD5 d2dbab4fba3864877c735547e8005983
SHA1 56201b0ba84c315ce34945c4d88aa80cb287f1a9
SHA512 1324bdc608610effdc3c6355100ebc82bb580882ddf8ee09b7a54e8dc0437fbba0ba5953f38575fc8b297049910dd5437b89fe2a768772f95c64da56eeb81fe6
SSDEEP 192:y0Q6g/g30oB9u8tIrWO20ifyT6kAmIlV7QFW5vPrkB:0Ys/5OlBlV7QFW5vAB
TLSH
T12502E9D4A3E483F3790DCBAC86210563743A30FEBBA2525DFC9F65126B529C54C5E8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\ykPUYuH\v8_context_snapshot.bin
Size 696KB
SHA256 1df86ae706c6fc60bb6f4e60d76c5a3f56affa54e6b1442f51127bedc589d089
MD5 ac1ecab348d666e70d3bfe6877a43f99
SHA1 7e22faa7dd16b965c4af9e6b85b12a11d2060f19
SHA512 81bc684328821627718339eca626130380dad46c9c024df775d5356ca20a5fa9cc55b48f8e9d7ea244f065c86977c952a14c7dce29963f1c5afe1285bdf76d08
SSDEEP 6144:9af8tLrT5X3ukt+H92AqD9clxP2NyhaigNw69I3ndbkboE/UZ703yCTzrWD:9af8tL35X3usCN2NyI4NbkboE1rTzm
TLSH
T197E49761F71ACF26C6493A7D8DD657463930B2CE8E46E24B3406B33E78B96704D3662C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\ykPUYuH\vk_swiftshader.dll
Size 5.4MB
SHA256 335d9fef1f53f1a6c3ccb5b65bb5e906de6fb4d02de221610e760616c90d5b76
MD5 1d2faf83241c9171053e195133153b9a
SHA1 d85f8f9eebdbd3749663ff5efbde8c3b8057f31b
SHA512 c90b86425b4e8bd42b1b2d86409156328696af6257aec50ffe7d3d7c1f1c260f64f128d6f3c005886b062db7d61af8627eef20c3c2a8bab0d4a49b48f870ae2e
SSDEEP 49152:FhqQRjgbS5A0V4NmoIb193Km3QIH6hvweSNerodqG5iBgP6zPPvT48unNHRVq45N:F1gbID4lz8ZlwZswtwmdXnO
TLSH
T1E5463803F28681E9C06DE579875FA633B631F8850B2276DF56A00F192E66FE06B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\Local State
Size 434B
SHA256 4db40e275724120abf841e2a8e0a40c2cb00fe74175b12328924e87c493808d5
MD5 16348249ae00b83bf61ec492a300cf3b
SHA1 f2a642ec121855852454f4482e2598cb283957eb
SHA512 88b9e4e4c116b648da85276a29ede1c932b78a93bfcb6731774b58e17e8355ecd8f3e4d1f09094b6f56565d9f177d699e2373892d5650de641d494443872208b
TLSH
T118E0ABB6A6D33D6822E681A0873A2A020E1014AB83442EE1A6289146307551AAF08CB3
MD5 SHA1 SHA512 TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\PraxoraRender\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daemons.log

Path C:\Users\Admin\AppData\Roaming\daemons.log
Size 8B
SHA256 de8cb579d3ddafffcf73e3637eac5f9d79e94c1ceffff25f7d720f745e7450d1
MD5 8dfcfa9af680c87ec738271ba82883cd
SHA1 aee488034ee956c44742e9f3aa713d764f194c8e
SHA512 46f71242b1f4fd0f03ce3bf26692074611b9b7083f55e8141e78efbbb944b15b9a3cb939469c08b90bc32a9464af7c375bc7c84040574409018c1ae2ae7ddfc3
MD5 SHA1 SHA512

Submit Download

CircuitH128.exe

Path C:\Users\Admin\CircuitH128.exe
Size 215KB
SHA256 1c7faf9552b916f851eaa6bddfe77ebab42916d9cf8ddef2bbd3baabf56d7c8a
MD5 38141bdeaff82c9bdfffe7706f31e403
SHA1 5ec8799b0bf9a987ded4d0394f30d8a4207c3ed0
SHA512 053ad0a5aae63f5e7273b3b3313738488792ae4573393b04424e6abe1414481d7aa9a7b6798b932684fcf29c01fc4e6f6721d626346d84c6e2d8604fff96cc7a
SSDEEP 3072:lymFMGVIqiHUAGRXkpO0ArOjQmd6+wnC6TgEYkiNo4pKX5nmLklACBmMiC7QglBB:0GO0XkpOPCygErifp12BX79BJNL71
TLSH
T116247D103EF2C5AFE566193C007F8BE31EF9E7220E3518932694696D697C3815D3A62F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a4315.msi

Path C:\Windows\Installer\e5a4315.msi
Size 5.0MB
SHA256 c819eaf9fd91ed4bb72e62085344d402e7317eb6ded9e6a71663c85a242d7757
MD5 debf45863852b6daaa9f51389a2932b7
SHA1 4f4f22158fb10c2c7daa0babe2417a08f4a9aee0
SHA512 8e0319367c3c1aec74a15adb8a4061478b9f6a0d85136af303cd2858391bed48c5b45743a18b65e83c815a98e694e3faf92cc3afe8b8e70ab00b15595818f9da
SSDEEP 98304:ULHHlEF/+mxA3lZ5dFvI9jfqTNUROsONQscG1gg/s78HVMa:iitlAnFsquTONEGOO
TLSH
T1C9363328E8C81313CFC66BB242054D876927FE8173270416B93B3AADADF177746947B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 1eba4365166aee3dcfac5fd9cea7dcc83d6e2e4ad9c91c8c7ee401130a26de82
MD5 cd08b6cfa8f97bccb2faa65ed3557734
SHA1 da394a1abf5ff049e77fe6716107260d3221030f
SHA512 8384d82bb052e371d43a845469a181ad9a5ffe2ca44fb7fda1336a0facac2f257a2ab513f3a31d7f93d578c65944572070be230957b1d60f8eb8454b9721746f
SSDEEP 24576:5Fo3DMPPdoO/vvTL/yghRClw/LubKr2iEMHD9MvZHkP6pWQRsYx2RILAVet:DHc
TLSH
T15557D12436F92210E7B79E7CB8F06A634D3A7D5B9C15DE8D05411B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{64ca497e-eb64-4573-8618-839b65e8a6a4}_OnDiskSnapshotProp

Path \??\Volume{c4ee2a5b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{64ca497e-eb64-4573-8618-839b65e8a6a4}_OnDiskSnapshotProp
Size 6KB
SHA256 473a054f6b7405a8f518e794fb83f75543fc76ee3027d7b03739ca06ca9bbfb8
MD5 504c1272ebe1bcc88a4faf1e9caaabbb
SHA1 dfc41ffdccdcd7f998238d552371a051b057c4e6
SHA512 e62df677d392bc4262cc4c180a9ccab6a6869d76ed77c48ad1f80d9bfa4f4857c89c5f96b80479892d1cb449de6d67ad6d4d96fe39e3e6545b3300ac037596a0
SSDEEP 96:F2FauBvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:EFDb++uVmN
TLSH
T1ABD176081AF54711E2B3AB7229F18557A877B911FF33CB8E0198638E6660910F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-118-0x00007FFDEF080000-0x00007FFDEF2E3000-memory.dmp

Download

memory/1188-2673-0x0000000074C20000-0x0000000074C72000-memory.dmp

Download

memory/1500-60-0x00007FFDD2A30000-0x00007FFDD2A93000-memory.dmp

Download

memory/1500-67-0x00007FF633800000-0x00007FF633884000-memory.dmp

Download

memory/1500-54-0x00007FFDD2A30000-0x00007FFDD2A93000-memory.dmp

Download

memory/1500-56-0x00007FFDD2A30000-0x00007FFDD2A93000-memory.dmp

Download

memory/2852-42-0x00007FFDD2A30000-0x00007FFDD2A93000-memory.dmp

Download

memory/3332-72-0x00000000008A0000-0x0000000000C5C000-memory.dmp

Download

memory/3332-62-0x00000000008A0000-0x0000000000C5C000-memory.dmp

Download

memory/3332-66-0x00007FFDEF080000-0x00007FFDEF2E3000-memory.dmp

Download

memory/3332-68-0x00000000008A0000-0x0000000000C5C000-memory.dmp

Download

memory/3332-73-0x00000000008A0000-0x0000000000C5C000-memory.dmp

Download

memory/3332-77-0x00000000008A0000-0x0000000000C5C000-memory.dmp

Download

memory/3332-79-0x00000000008A0000-0x0000000000C5C000-memory.dmp

Download