hijackloader | 04b9cce52af1b7ff4f52a2ccf69deb161fef821acc61aa12c3866f2885263297

Resubmissions

04/10/2026, 19:00

261004-xn51fazvev10

04/10/2026, 18:57

261004-xmfddszvct10

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/10/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Grape.exe
Size 99.7MB
Sample261004-xmfddszvct
SHA256 04b9cce52af1b7ff4f52a2ccf69deb161fef821acc61aa12c3866f2885263297
MD5 4c56b85558e7aba7dfdf492564837779
SHA1 1961dbf19dda3d825cfc4899ea0f0efcd31fdb80
SHA512 4e3f91922f2d12c2bf9c78ffc9572aa3a3202e40c27b637a448143425d03ac9a202bd0b3260826cbc6dce85c7e9b9381bdacb8c57d711af5d61c766b900cce6c
SSDEEP 786432:UqsjvUsvRjAfHvoj7/B10GczN5xwcJXTpWgYVvPM96Rc:t2vU0RjyPoj7p10GuN5xrXTpW8L
TLSH
T1F9387C03E3A610ECC09DC2759B1A9526EEB2BC450735B6DF266467212F76FE06B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution hijackloader loader persistence spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\KuxionPort
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002437b-26.dat	family_hijackloader

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Grape.exe"	Grape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Grape.exe"	Grape.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\D:\	DriveCircuitry.exe
\??\F:\	DriveCircuitry.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1768 set thread context of 3844	1768	DriveCircuitry.exe	107
PID 1768 set thread context of 5860	1768	DriveCircuitry.exe	123
PID 1768 set thread context of 3844	1768	DriveCircuitry.exe	107
PID 1768 set thread context of 2320	1768	DriveCircuitry.exe	136

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\index.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	DriveCircuitry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DrosuraCloudlet.job	DriveCircuitry.exe

Executes dropped EXE 2 IoCs

pid	Process
3716	DriveCircuitry.exe
1768	DriveCircuitry.exe

Loads dropped DLL 6 IoCs

pid	Process
3716	DriveCircuitry.exe
3716	DriveCircuitry.exe
3716	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1828	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DriveCircuitry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DriveCircuitry.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriveCircuitry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriveCircuitry.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3528	chrome.exe
4712	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1768	DriveCircuitry.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2508	Grape.exe
2508	Grape.exe
2848	Grape.exe
2848	Grape.exe
3716	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
3844	chrome.exe
3844	chrome.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
1768	DriveCircuitry.exe
3844	chrome.exe
3844	chrome.exe
2948	Grape.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1768	DriveCircuitry.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeDebugPrivilege	1768	DriveCircuitry.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 2168	3832	Grape.exe	87
PID 3832 wrote to memory of 2168	3832	Grape.exe	87
PID 3832 wrote to memory of 2508	3832	Grape.exe	89
PID 1160 wrote to memory of 4660	1160	Grape.exe	95
PID 1160 wrote to memory of 4660	1160	Grape.exe	95
PID 1160 wrote to memory of 2848	1160	Grape.exe	96
PID 3832 wrote to memory of 1828	3832	Grape.exe	99
PID 1828 wrote to memory of 3716	1828	cmd.exe	101
PID 3716 wrote to memory of 1768	3716	DriveCircuitry.exe	102
PID 3844 wrote to memory of 2428	3844	chrome.exe	109
PID 3844 wrote to memory of 3528	3844	chrome.exe	111
PID 3844 wrote to memory of 2828	3844	chrome.exe	112
PID 3844 wrote to memory of 2828	3844	chrome.exe	112
PID 3844 wrote to memory of 1856	3844	chrome.exe	113
PID 3844 wrote to memory of 1856	3844	chrome.exe	113
PID 3844 wrote to memory of 1264	3844	chrome.exe	114
PID 3844 wrote to memory of 1264	3844	chrome.exe	114
PID 3844 wrote to memory of 4900	3844	chrome.exe	115
PID 3844 wrote to memory of 4900	3844	chrome.exe	115
PID 3844 wrote to memory of 4600	3844	chrome.exe	116
PID 3844 wrote to memory of 4600	3844	chrome.exe	116
PID 3844 wrote to memory of 5196	3844	chrome.exe	117
PID 3844 wrote to memory of 5196	3844	chrome.exe	117
PID 3844 wrote to memory of 5428	3844	chrome.exe	118
PID 1768 wrote to memory of 3844	1768	DriveCircuitry.exe	107
PID 1768 wrote to memory of 3844	1768	DriveCircuitry.exe	107
PID 1768 wrote to memory of 3844	1768	DriveCircuitry.exe	107
PID 1768 wrote to memory of 3844	1768	DriveCircuitry.exe	107
PID 1768 wrote to memory of 3844	1768	DriveCircuitry.exe	107
PID 1768 wrote to memory of 5860	1768	DriveCircuitry.exe	123
PID 1768 wrote to memory of 5860	1768	DriveCircuitry.exe	123
PID 1768 wrote to memory of 5860	1768	DriveCircuitry.exe	123
PID 1768 wrote to memory of 5860	1768	DriveCircuitry.exe	123
PID 1768 wrote to memory of 5860	1768	DriveCircuitry.exe	123
PID 1768 wrote to memory of 5860	1768	DriveCircuitry.exe	123
PID 1768 wrote to memory of 3844	1768	DriveCircuitry.exe	107
PID 1768 wrote to memory of 3844	1768	DriveCircuitry.exe	107
PID 1768 wrote to memory of 3844	1768	DriveCircuitry.exe	107
PID 1768 wrote to memory of 3844	1768	DriveCircuitry.exe	107
PID 1768 wrote to memory of 3844	1768	DriveCircuitry.exe	107
PID 3844 wrote to memory of 3668	3844	chrome.exe	133
PID 3844 wrote to memory of 5992	3844	chrome.exe	134
PID 3844 wrote to memory of 6000	3844	chrome.exe	135
PID 1768 wrote to memory of 2320	1768	DriveCircuitry.exe	136
PID 1768 wrote to memory of 2320	1768	DriveCircuitry.exe	136
PID 1768 wrote to memory of 2320	1768	DriveCircuitry.exe	136
PID 1768 wrote to memory of 2320	1768	DriveCircuitry.exe	136
PID 1768 wrote to memory of 2320	1768	DriveCircuitry.exe	136
PID 1768 wrote to memory of 2320	1768	DriveCircuitry.exe	136
PID 3844 wrote to memory of 4712	3844	chrome.exe	140
PID 3832 wrote to memory of 2948	3832	Grape.exe	142
PID 1160 wrote to memory of 808	1160	Grape.exe	143
PID 3844 wrote to memory of 6032	3844	chrome.exe	144

C:\Users\Admin\AppData\Local\Temp\Grape.exe
"C:\Users\Admin\AppData\Local\Temp\Grape.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1800,10417180025422923775,16506496514616138641,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1832 --ignored=" --type=renderer " /prefetch:2
  2⤵
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=utility --field-trial-handle=1800,10417180025422923775,16506496514616138641,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2200 /prefetch:8
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\1791140472212\DriveCircuitry.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Users\Admin\AppData\Local\Temp\1791140472212\DriveCircuitry.exe
    "C:\Users\Admin\AppData\Local\Temp\1791140472212\DriveCircuitry.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\ProgramData\KuxionPort\DriveCircuitry.exe
      C:\ProgramData\KuxionPort\DriveCircuitry.exe
      4⤵
      Enumerates connected drives
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Drops file in Windows directory
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5860
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2320
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1800,10417180025422923775,16506496514616138641,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1156 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948

C:\Users\Admin\AppData\Local\Temp\Grape.exe
C:\Users\Admin\AppData\Local\Temp\Grape.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1920,2604194623738121899,17632861889266263365,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1932 --ignored=" --type=renderer " /prefetch:2
  2⤵
  PID:4660
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=utility --field-trial-handle=1920,2604194623738121899,17632861889266263365,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2276 /prefetch:8
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1920,2604194623738121899,17632861889266263365,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:3180

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:64

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd047fc728,0x7ffd047fc734,0x7ffd047fc740
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,14149144893002204257,14768129669526494436,524288 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,15377810445714145220,17845737282551646051,262144 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,10059952942912777098,24652957897701522,524288 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,18179796401315949656,11322123489417858036,2097152 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,206372990416205932,4671515782033913865,2097152 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,15497135747601659640,14076433468594966275,2097152 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4452,i,3635892387290800071,11817744423334371019,2097152 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,13953507612922889284,2271590122479784821,524288 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,15042201020276431478,6108200249936449771,524288 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,697083229447272874,7135009497377056830,524288 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,16716087174367719246,10177933431584486156,524288 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,15598712891204402025,16841782140319431877,524288 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4296,i,6955654730838912370,16293737521035663830,262144 --field-trial-handle=2184,i,8432159289409504608,17223823494157556905,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:6032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5cb3862aab6f7adfb9ac581d003b2a1ed9e94cf3

Path C:\ProgramData\Gebilaxu\Heleru\5cb3862aab6f7adfb9ac581d003b2a1ed9e94cf3
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

5753b5d0-7310-4293-bb1e-1ee52813bf90.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5753b5d0-7310-4293-bb1e-1ee52813bf90.tmp
Size 264KB
SHA256 45690c1c11bf5b35a5aacce6d10662f1821ea6fa2744ee6f86c9d4a3363839aa
MD5 badcba0534224ed6d1894a426b6e4fa1
SHA1 b43afb6f2d6d05c34fe8155435c1ecfc2732cf90
SHA512 d20f21b48ec9833024ee8a2b66f71f848863fb7f75f8811e568692adeeb865445fb210eaed2dd27eef5dfde768da8c801111a48a759ac8c52d1fe9753419638d
SSDEEP 6144:KnNb30A1kekNShdDABYP+hFD+7t56OD9ZfSAppra:oNb30YFjyFSXD9ZfS4I
TLSH
T18B44232237A4EE3F86B5D64191AB6B098D739CCB044FB90EC54ACF5A52CE94D0732D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c637d3f-7e2a-45b5-be21-327179737171.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2c637d3f-7e2a-45b5-be21-327179737171.tmp
Size 12KB
SHA256 5913f855c7db1fe94df62bf73edfc029138034c89d2d31311aee03b49babd2f0
MD5 c75defc3d86d78f6a82692bce7f16ce7
SHA1 bc11b0df795aa43706b8c4db59649a34e61df4d5
SHA512 5d337cb34ecbfb374011b1c20fec6b3b5bb792b5178e5ef36468b9ab031f82de3d853e49bd050109d05f603d4759cb2449244ef3a61dcbe3b66a92ce4bb8c511
SSDEEP 192:PRg6ezqFW4v7TpAPRp2V9WHsb+WNnq80+e0EkwgVyIsnAUgraJ:PRg6dWkvUX6UwT0+WEe
TLSH
T1B542852DEE10B57B5CDBD22AEA167753E7F9102121A42E88E6F8C93C25DB5CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31dac12c-8a8c-4152-9382-c5f843f80b6e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\31dac12c-8a8c-4152-9382-c5f843f80b6e.tmp
Size 12KB
SHA256 5ac1db8f4e5a49db2503243e5f4b6e7395ceaa9b3c6b51715eca09a6a94172bf
MD5 3357c2e182a99d311cf4a1af86689a2d
SHA1 9ebd5768629ff8170e1978b4f8fdcbf34abd1cc9
SHA512 4aa685cd42a38742a30641eae0ad2f7186b60122f3338f18e0e89c2d026c2d25de4ffc7eb5fa9e0f86919bd463236f3e66e874b48995f292966d528ca18c18b4
SSDEEP 192:PRg6WzqFW4v7TpAPRp2V9WHsb+WNnq80ie0EkwCVyIsnAUgtaJ:PRg6VWkvUX6UwT0iWi8
TLSH
T14A42953DEE10B57B5CDBD22AE9267753E7F9102121A42E88EAF8C93C25DB5CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56a95beb-6cb8-4edf-add3-c67a2d9c5e5a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\56a95beb-6cb8-4edf-add3-c67a2d9c5e5a.tmp
Size 649B
SHA256 f9d7ca7771c3e4ad305ecb19dd48db43dfd33794046cec589a2200673bf49495
MD5 35314d038ad742826bc4c96f7d8df454
SHA1 c64ab079cae6b06f01e2ac6f4fc9cfd72eda5c32
SHA512 6a020beea10ea5fe13b3e0c58920d242738bc45c03e9a9001473bbfa723606078a624059b5074dad4a906d6dadd418166d5998a13ce67799e03bf0c6d628af04
TLSH
T118F0F4B5C921EC2B18FD272924954B46EB5023273B90984F3B3D810C8FB167B468681C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c0d9f00f6e8739a7d71c4febe05a8e1fd3a40f95704b23b4115de855b923d6fc
MD5 3b4f664940a7e4494f78baed829f3ef4
SHA1 7f5c9160f24fbc309065d0d5794bd1e6e56b9404
SHA512 be66c63b8ea2c21a09eb98d9f603f5c21bac9bcf2bd60af6eb45d794c2e29b3335d359f706f74c8b4c18717243b1c7abd674123fde2a787425f2c932ec466047
SSDEEP 12:dINQTEDwueeE9FymeMT/Sk3/VRJrkrEd:dVTKwuMXyaT/Sk3/VHHd
TLSH
T1CF134F6E6B014BAAEA4C647B292B7BB803B1952595C34273D660F3317542E93362F701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 8KB
SHA256 c66db23db82d7fbbce511098fd4f391ca7669212494cc330256bab5e002750cd
MD5 9dd7530fb20a28c56762e7e932fe4490
SHA1 1549898ad2bfedd468ad520c900ac524b0e15f50
SHA512 2056a9089c692387b2a5e2c6b659c3d9c6f14660cd340d44f0be0fd6512157dbaf166fd865190bb907d745511efafce3b8b95f3ed837a558440497e65145fe61
SSDEEP 3:OlH/lnoqCKzEtcWpXnBeqCeKP/Vy1XadPxQlolWeqfK2RqOqK1caa+:KqqCOEtXYqCbtcqQl4v2Rqo
TLSH
T1EF028C5BC6942140C8E6EA3A8E5372C007036A1313018D24B1060376F22031395F1184
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 95c78efd7fe4ef5f873434d38ffd2f584c643dc0ca2ed0ca7a18fd0c11e38d3c
MD5 ffbfa94ba593b352b87766024e9b8ff3
SHA1 6401fde8b5db4d79adb3d35bc42fdd17f800d4ec
SHA512 1ca796bbd7222e2e54ea24b7f55e8622eabb93e6715f8d983bf79d6aad1db15a30d7ba451f34cd3e91f8e9ad2192a78b72ff14c2035f9c3629aafea7d7f32416
TLSH
T169E086E4248AC26D545985B3836D634DCFE07418A6D438173B95D840318A508F2D0672
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 1KB
SHA256 c8f4c8a8f2b83f2446f96a4b23b655cbddb1a18609ee3b4b177c49b8a396a019
MD5 255a534c9a60cc280ea2f8fe38bd23a7
SHA1 61e50f74a5145fca4f04dc86544398b744f6028d
SHA512 0bf87a509d9148a180e120e9e9c4c7b9c901999b6780aca4aef93191307fbb339a993c383f76732755ebf18f82aca32da48df54211faa8b70f638d8fcb6793c1
TLSH
T1753152F4FBC0A9ABC51A1EB37CA243130F71884002C4E88617EB58701D82FA11B330D9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 308B
SHA256 6a774b3e7d1bf05e94e1a02d55b6ebac89d713fdd69ca49d542c0d07b0d72dfa
MD5 487ab6947311f70e0f0c0250b5d9f241
SHA1 3f22da1779000365beab28a72dd6e9a2ced86f31
SHA512 a825fc2c304b34273377db2e11444452396bf8005eb46d219d479ff0f85cc1a76f61b27c7ba1140b34eb213cc1620492e21d46cc57d2d00b0e8fa12bc94b0235
TLSH
T1C6E086D6259AD77F196B82171368B35ECFE434189AE914562B00D494718D404F1D0671
MD5 SHA1 SHA512 TLSH

Submit Download

552f9f71-2f8e-4eb8-b3cb-b015ee596b11.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\552f9f71-2f8e-4eb8-b3cb-b015ee596b11.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9f1cea41-69fe-481a-b3d7-f8370608119f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9f1cea41-69fe-481a-b3d7-f8370608119f.tmp
Size 3KB
SHA256 31aa05528486bbdc010b38c9dc7178603788d9e002428e0f9ad92e315b82a5d5
MD5 8bddef7db919e45f1ccab3c344292da0
SHA1 38c974febf2231d33793fa5cf9350ec210858a42
SHA512 430ece0cf17a8b3091f15b6e450ca4f55d76cf8381fb2a1cc10f67f79d8a491ed47a6aaf03c9f345e6fbb0ea5eb805943687ba7ba7feb9103898e88e2303333d
TLSH
T18B619CF3C7D8867DC80156F4AB216E1EDD790E28522D3C56C8D8AE5F53E28B2D25068E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 1917286ae7330131a54291100524a58d181601da8c7e3859456ce0f3a2de0f78
MD5 e55de1fa4053c3ba978cf47299ef54d4
SHA1 d652aa0b4d81a7eef215645c0a1df115e6ff1fb4
SHA512 9ae45f4973d43fcbde8bea8b21bf8800de5caf32bf079f48e35a005e987a698106ed3d6e48a266196c6f5399f137429d141546cb81fab05cc080d50f8611073f
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoOn:OIEumQv8m1ccnvS6GG
TLSH
T1DAF2E1FF07197501C0E49674D6810ECFFD2D051D4B9BBEC09AAC09F3AB865A39538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 68fc3cb88672667fd7b1735d9ee9fed7f08482a700641cf32e7ec1070eab2e7b
MD5 f0b863b4d55e8b2a8a03ecbc0d3d1c74
SHA1 b856c58f3befabad3f9381778089c81fa16e424d
SHA512 e52a74b88a93ff61a1797693893547e01a8b47531d46ceb30f6796ec6d16d9a70c4e9a3c9397aba4821b3728244953cff164f921fdf357c11d5a543f0303a2d6
TLSH
T100B01284C4525312C01202F81298688C3554EF21A609130542F40D41B835190812B095
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 21c3266796f92917d521038e3d04f2a2115fcddc38cab9719ccfbb891248a64a
MD5 2001c14c39c926a0cf6ad388fb708a08
SHA1 b98a77d4e355978913fd780606a7ceaca395c403
SHA512 63a5f4577cad530e01e3c1d759bf5ce6656387be6f0913b7e56651d480edc928bd590cb0695258b682762a1d4162299256993c518c9b9184dfaec55ed03e3344
TLSH
T19FB02283C0032282C00203B238F0A2C8B020CF30C203022BC2E00EA2EC282A20A22020
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 270B
SHA256 3530055a62ddc24a89dd97751ac9db187d009eb8193a29a3636cae2567d4a4cd
MD5 70ef71dd0fed6c14b2b6e149267a2c2a
SHA1 b8829ea9631cd5e0aba87d81e71047ef5fa92f24
SHA512 2ed43127bcd5443c4cd04a01f70de06c50fcef1f284ee4dfec07e605133aa5cd6a1e197dbc0c6e73679af491b976a7304e8d38d58c948cb55471399978470241
TLSH
T1F3D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 aad389b89c15a5b919977edc9c8f83c937fe58c599c51981d10ec3b69f904950
MD5 3f974edabbb6e8b444b5dbe615e8e772
SHA1 10b5c4ffdb23a438e667affe3af7429412ec1566
SHA512 037cd75d4b92bf9b67e1b07ad4f2ef4e5ff052e7c6a084a7676700fef958a1dbfa8ec251034e819287bd1b5bede2bbe0785b3d76c57601be8299e31b76234fc9
TLSH
T1ACE086F4248AC36D155A802B036877CD8BF5740CF7E82C463B45D540368E409F2E02B2
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13435614088443661

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13435614088443661
Size 2KB
SHA256 8ac8b7e153e53fab9f997280aa64355c2063b9e9513c6dead70a49c57a5d9029
MD5 e324e91f9f368dd7c78f125a19b603c0
SHA1 28f30fabacf12db95430ff55173b7ded59be7c65
SHA512 0a08858939f21293f97fe7d7e0120ad08e2389b100c9a003c6728d40dc32b1adaf481786dacca3e03e1674fca3bddd8c0a3917932892112785a35653f6daead8
TLSH
T112517D1656E8203EE57F413985F610E6BF3EFA4230969E1FE16151140CE3B432EF5EAA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 fec9087b46f3f395a7f8399f00bcea2d779201c06c2ec0051cc193d43d1c75f5
MD5 61839c5a0683ce99b64fc684352377f3
SHA1 8af29342649e4a8aa919412c16c528852f4b1509
SHA512 c1fd714f7ac790f7436bf0b7f86247625887e722a02145161f62357863d20c70d532f2aaf3e908427a6d6c2006b093a8198f981354d02d5ee8d29fe6761f1ce4
TLSH
T115E04FF026CAC72E148A945F1774F74E8BF2B408F6F914163F16E69062DE514F1E26B1
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 afd7553d7382e1c8f91d3ee04ccca81c62bbddf0ef9716b6484afdccfeb6d9b7
MD5 a3719809abe68683b238bb390429b687
SHA1 477cd1e94fb09aa37895a4d411d82b28e89f01d6
SHA512 3baeb945c810eedb32b49a14d22eddcdaacd306d25d98a935a5a29db05be4056ad0034ace5ea218a69d480541ba46da4ab1f2045b325cbc1e31ba5e2c010614b
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OZNiVumpGnc:1nbZeMrv/hGtZvnc
TLSH
T175D3984B3A747002EDE59A721CE050BB5E3CB16D4F55A5D4287620688EF2963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 0a9f27098486f63c8083016bfa3e894f81dff9678e3f889f7ea0afc68520c8a0
MD5 7dbe1b84b0f311a5e7b5d04ad58d6dea
SHA1 7a8a90dd11251010c6b944559c3c4ff3551dfea3
SHA512 22638645c215dfb77d9f8d100687e92351eb1bc5c333b56666538ca09e346951f55124bcc90764d6620a82785683a7cd37d0e2fdbc0d33a60412d595cecc643b
SSDEEP 96:f7doKsKuKZKlZNmu46yjUKVXwX4I+XvXJh:7ZT0nzXggYfT
TLSH
T1A303418F662840F3D0B6C23EEDD145D6FC7C1508A7133AD419ED0B655EAC03350546A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a853c7b7-52e1-424f-b892-3dfbda977ae8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a853c7b7-52e1-424f-b892-3dfbda977ae8.tmp
Size 17KB
SHA256 523761bc1813672aed3255e4becb28be826b1abc952b1618d2bcfadebfe5e21c
MD5 472d61bcf21443a047dac261aad552e8
SHA1 608e068876727f4f676b88d75ee81c5361cbab00
SHA512 c732c8cc57effcc49d70faf34528b26e9138b9a4c90bc7197c1b7efc3bd7d6aa9914d2b1dd802f59451918a42148b21a62cf31325f4ca0e95e28d8b96bbf35b5
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5S7pLuLceSZkXOD/q+ErU3v7HGISxpQ8:TN/O7KxkXqKf/pUZNCgVLH2HfgsvS7pC
TLSH
T11472F867BC489A3B0F94C6CCD8167B4FEDB9024B65E9886446FB983503D4ADF11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b75cdc64-fcd9-49d8-af4a-360fca2a6463.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b75cdc64-fcd9-49d8-af4a-360fca2a6463.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 21KB
SHA256 71bc3d5dd0255855bf44bc074d65e569fe00ace315b577f578d400c020500cbf
MD5 1876ef01845ea713d185f8348418e9ba
SHA1 c3196ed5efc9630431a32bad75964e608c477728
SHA512 bd5903598f1093df0446ca9890bbb31e5f6e4737a960809c2c7a62ec04e8fd43f3d138be9d4648a6215d343ec77176d1a9471cd733abaa32683e4317d07065b4
SSDEEP 384:UV/tsdGtm0Bf35QkIIIbbLMIMqBW9gJsdGfZnQTsdGHODsdG6dGSZr:5OBQT2zZr
TLSH
T18AA2A89AA3741B81CC8F97FBAC5B8D3E1B729CC9D1E60011A496967FA833F0749413D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 6fd3d1a1e97b8314526080d5f22920b727bbcae2033be3f66449df6a4f1d84d9
MD5 4d616ac98fa6c379e81b73beec72ad21
SHA1 ebcad16bc3bf9128d0da6fa61171187763cf61d4
SHA512 f40e775166eec8f0f1726473b8e162699e5ad4650633da853d5e61e32545e6d76e0cebfaf43a2a5bbc0c3b580871c28d4f91c73210ca2dbd44b7f59b14ae47ff
TLSH
T18AE086F479CAC3AF6459819B1368A38DCBE17809EAE4154A2F41C448658E90CF1D0272
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

b0215165-fa1e-42dd-b915-f769ddde6e4c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b0215165-fa1e-42dd-b915-f769ddde6e4c.tmp
Size 265KB
SHA256 7037158691041043277b33fb2840a130f34307144bc2c4082efceaa28b19b827
MD5 18652bbfd032f25b9102fba77190ac9a
SHA1 8ffecadad756eb463f5e4b0f7f4ffc748010cc4b
SHA512 a0812a4d0c28be698781d9cda821750357a48c342f093cc3cc5ab884161471eadca46dfa591a9171304765471eea1cee75b267e29b3131406bfae0e599dcc493
SSDEEP 6144:GnNb30A1kekNShdDABYP+hFD+7t56OD9ZfSAppra:kNb30YFjyFSXD9ZfS4I
TLSH
T1CE44233237A0ED3F85B5E601A1AB6B088D739CD7444FB90EC54ACF5A52DE94D0B32D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d66084d9-9c58-4b0b-9923-a6f0de5aed49.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d66084d9-9c58-4b0b-9923-a6f0de5aed49.tmp
Size 264KB
SHA256 2a91ccce551da30d8ce5aa9819544f449ab3f236d25a56b5902b019b67171041
MD5 3be37228efe88d292b09c8d1e757d044
SHA1 2c68d9ef870eca0308c12ca7f01838db7e9e8143
SHA512 d942c46f12a0437f801f3799ba2490312aa5e35f8171ca12c6696fc5e430977948be459ae58a362a0425c004bf3e002cac54fdfa4080dbe234cdf0d0f3fe584d
SSDEEP 6144:DnNb30A1kekNShdDABYP+hFD+7t56OD9ZfSAppra:TNb30YFjyFSXD9ZfS4I
TLSH
T16844232237A4EE3F86B5D64191AB6B098D739CCB044FB90EC54ACF5A52CE94D0732D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f18c9f69-ee23-448e-b58d-dba03b95aff9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f18c9f69-ee23-448e-b58d-dba03b95aff9.tmp
Size 130KB
SHA256 6d77cac347b045f5885d9ebe3ae1d6d5023ae70eb51e8afdc61cb5f5403a319a
MD5 57bf1d4c1f5c83d410ab7375d690f62b
SHA1 1985a53cd7255cef190e80d560af96365985d8c5
SHA512 9006830f5adb8b44873770095050201d5eac25992eb3438717a253c3f1e659afa784b2e54688a3fe47f89cf205b98c1ecd7e7c7042954c03d2b58ff2c4a4ec4d
SSDEEP 3072:6+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:6+hFD+7t56OD9ZfSApprU
TLSH
T134D31232AA91D8BBC9FD6541B197A300DD766CED41DE2A09444A5F8EE09FC4D0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriveCircuitry.exe

Path C:\Users\Admin\AppData\Local\Temp\1791140472212\DriveCircuitry.exe
Size 1.7MB
SHA256 399d07658c7d30dffb42b1e4b83904f5334a93cfb71f2516d5161d4cb4930c16
MD5 05b04eebdcedce5555b1e2d225c54c3b
SHA1 90d21f29df7f288d5711503cc00c4b6dae9db8d8
SHA512 971cf26a26b32e3d250255e50bc754cae545894b7e479378399a211c94bdf9d2cdfc23965a1875f1a5a201f01cc2b3c7c056f7103c9b76b0423ad8b25d1bca44
SSDEEP 24576:uip+eMB5CzFwhStFNEWwerW16DWpt8gd5rjNPyeDh0lhSMXlumm8KytGn:xMB2FAStFqff/8gL5yW8K+Gn
TLSH
T1CF858D317105C036E69212F1986EAFAE969C9E340BF658D7A3C43F6E59301C37B35A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

covrun32.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140472212\covrun32.dll
Size 1.2MB
SHA256 b52469ae233c5e8333e9e4d0304abafcdd3ca230fd0d4746148048a84a8a74c7
MD5 2c3247955a9517f1e31c6fe573c13007
SHA1 db5c2837788d312b39edeb497416df1c3e964a4a
SHA512 e32f44146ee304969c2c58c96e22491028610da21fb50ac6c0a5ad523d26912fafe4f03f109a6275cf447f73f082ad3129c1e0ec747ef055987ad325e69682a5
SSDEEP 24576:zvgVx+HPPKiqF9RXI/Nco6Y8XqyVHNotKhuR79jdt7Okaw9AYe3wzpBLnm2Wnj/6:jzHaiqF9R4FcYyqyVHNotKsvjdhOS9Am
TLSH
T1774529113295F025ED7D3E71183BEAAB5EFDBA613B7080FB53846A5B58206C1DE30E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord-rpc.x86.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140472212\discord-rpc.x86.dll
Size 580KB
SHA256 93541ae3a14cfdb5bbc2f33abe9d742ae28a6e2873b20e0bc18b9ff71a5e8e5e
MD5 00172a5a5fb1798968d10759cd242dc9
SHA1 ad75f873dcb0ae0ede9aa21c9168f2c8a9b1a718
SHA512 b85fa26cb094e038335e29f15aef4505311a804755c6ec6d70f593831259e9f1028447b7d4324c0c721fce7d77d6f6b62594987169045d8f10a5a646a75581e8
SSDEEP 6144:RWzsNrb2/twRx2ax9L66vBvOz+f8uOU3g86oxaeZnyHuKfILz4ta+b:RuqHKtEkaxcuBvm+fnZcuKfIP+
TLSH
T1ABC46D51B4808271ECE621BA82ECB63642BDE4F007146ADB5BD80BFFE7605D1AF32557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140472212\msvcp_win.dll
Size 493KB
SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 7762c51ea02eb943183d597ea0ee5530
SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
TLSH
T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registry-def.ini

Path C:\Users\Admin\AppData\Local\Temp\1791140472212\registry-def.ini
Size 22KB
SHA256 02baffa1b00f467ed73a995895f2fa3459fd1868fb1e13b9fbcfc6138d5e1ea3
MD5 99273bfc4bd985f5ba7311468675c127
SHA1 2e47c838913c28b4bd43e14f3b6b89798fc81a11
SHA512 c6c2f4498cd0effe0fc9394a7e3714f96fc6fd8e722d812c8add09cc2140ff4f7593ae718ce6a74ab7db6b938a4bae2b3af3efd8fc0224030b0cacf6722232cc
SSDEEP 384:ghxuq36riGxgbzL783C0hdxNcmIyiAcp/uIikOxEPGEIdOm9tb5YVQJv0mriWHLZ:dW6rlgbrUtooI9EEP9Iwm97YVQJv0iH1
TLSH
T1B0A29FF59D45B1B1F81AAC76A51886B3D710FCB4B92A00A3EFE514473C195FADB20D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140472212\steam_api.dll
Size 247KB
SHA256 9848b113a4cbbe430246bb87063cd3b9d65ae5f404a37adf9f9f03dfedc42fb7
MD5 442e3bd0b03314e819e0476e4e232a6f
SHA1 f8cb81fb6729dc7ab8b3f9ce06340508902b9265
SHA512 2e9eae049dc5987edc10bb669c9183a69817b29018c66116a59b00288760995a3820d08a5ea19952a001fbdc1f981d2bef56af3e28c480aceaaa8de9de140a14
SSDEEP 6144:eisYZCtnsm/LnKNtYMHGAIk9DRFjsylO2Cu2V6U:FsWCtnsm/Lit7mArQys2CZ6U
TLSH
T1CC44373538A149B1E5B581358AB8DE2F3AEC216B37342CFF634806B5C8635C35A3759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tracker_spec.pdb

Path C:\Users\Admin\AppData\Local\Temp\1791140472212\tracker_spec.pdb
Size 5.0MB
SHA256 0ddd4ad7b286d9a355c0cc7cd23cdece201e86cddd662b1e3fe7633b5202d0f9
MD5 d54e12892efffbe393910bd783728d60
SHA1 010851ac60da08c74ff1ec385aea908beb242045
SHA512 9d24d03fd4d9ba84316bdac4cba98493f72cc3dde6c16d51ad4d1273c23d1ab8b9223fc859a2ce9e5cf1371670accd395f61e0800f5796261f9484674acb301f
SSDEEP 98304:n2mlo7tPINolO4LRkit8cj2ah1Bzx2d/6vUV3R9WyMPvOxH/:do7tP+olMpciSBI6vUV3RcTv0
TLSH
T1E036231471E2593BE827AF01805B931AB2953DA8B215E3B260D775FF37395E8460EFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140472212\ucrtbase.dll
Size 1.1MB
SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 c4a25dce665733663284750666684703
SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
TLSH
T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6Zvtf.7z

Path C:\Users\Admin\AppData\Local\Temp\6Zvtf.7z
Size 18KB
SHA256 c77e1464ad0bdad7199b9cc990614ebe5c4d48fe34031a033c9e63512aa975d2
MD5 b249c7a4ab500766d90ca423507ce906
SHA1 0b91e161bc30b348556bd2bbff5299d392ec1fc7
SHA512 328f0d638b95c096afd55cfaadf6c26c9e48eb35892925ac5de7062db5ea8bb9f03372837d77811e3e896daa187bcd56bb8568e39e80350038233ce4fb470a63
SSDEEP 384:vJWDZcnb76U9p2upY9+ZZuJaoa3do0UyNmSQEPvZ+vO4dklCVtQtIsC:Ilcb7H9u9iu63KP1SQEPh+GlCyO
TLSH
T1A882D16A5DA52CD8748EE35FC805302CFCA14BD6E7BD68944B8F78EF16128C88AD50C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\kNuX4\KlLmqoum0\Default\F3bzmRx070\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daemon.log

Path C:\Users\Admin\AppData\Roaming\daemon.log
Size 8B
SHA256 1fd3dbd727381e3aba136bd2418a27a03d6d21db2c69c5dfeaeaebd9a6cb794c
MD5 02e684d08f9a2b24d3e7687d715715d4
SHA1 4f1bf797c36feba7b2d4658ab531f65a096e8730
SHA512 83ffc2258cc7e23c0752451d87adf0d759dc77fbeb138ff795d30114acf7f2156ec812c9df27d7b64eee9792c5b6898a5020977d93111862a889abfb8148dbed
MD5 SHA1 SHA512

Submit Download

memory/1768-56-0x0000000073670000-0x0000000073F92000-memory.dmp

Download

memory/1768-62-0x0000000073670000-0x0000000073F92000-memory.dmp

Download

memory/1768-68-0x0000000073670000-0x0000000073F92000-memory.dmp

Download

memory/1768-50-0x0000000074BB0000-0x0000000074C93000-memory.dmp

Download

memory/1768-61-0x0000000073670000-0x0000000073F92000-memory.dmp

Download

memory/1768-51-0x00007FFD23DD0000-0x00007FFD23FC5000-memory.dmp

Download

memory/1768-53-0x0000000074BB0000-0x0000000074C93000-memory.dmp

Download

memory/1768-55-0x0000000074BB0000-0x0000000074C93000-memory.dmp

Download

memory/2168-267-0x000002957F750000-0x000002957F87A000-memory.dmp

Download

memory/2168-215-0x000002957F750000-0x000002957F87A000-memory.dmp

Download

memory/2168-141-0x000002957F750000-0x000002957F87A000-memory.dmp

Download

memory/2168-3-0x00007FFD22A60000-0x00007FFD22A61000-memory.dmp

Download

memory/2168-63-0x000002957F750000-0x000002957F87A000-memory.dmp

Download

memory/2168-323-0x000002957F750000-0x000002957F87A000-memory.dmp

Download

memory/3716-27-0x0000000074890000-0x0000000074973000-memory.dmp

Download

memory/3716-28-0x00007FFD23DD0000-0x00007FFD23FC5000-memory.dmp

Download

memory/4660-268-0x00000178BBC70000-0x00000178BBD9A000-memory.dmp

Download

memory/4660-142-0x00000178BBC70000-0x00000178BBD9A000-memory.dmp

Download

memory/4660-64-0x00000178BBC70000-0x00000178BBD9A000-memory.dmp

Download

memory/4660-324-0x00000178BBC70000-0x00000178BBD9A000-memory.dmp

Download

memory/4660-216-0x00000178BBC70000-0x00000178BBD9A000-memory.dmp

Download