hijackloader | 04b9cce52af1b7ff4f52a2ccf69deb161fef821acc61aa12c3866f2885263297

Resubmissions

04/10/2026, 19:00

261004-xn51fazvev10

04/10/2026, 18:57

261004-xmfddszvct10

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/10/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Grape.exe
Size 99.7MB
Sample261004-xmfddszvct
SHA256 04b9cce52af1b7ff4f52a2ccf69deb161fef821acc61aa12c3866f2885263297
MD5 4c56b85558e7aba7dfdf492564837779
SHA1 1961dbf19dda3d825cfc4899ea0f0efcd31fdb80
SHA512 4e3f91922f2d12c2bf9c78ffc9572aa3a3202e40c27b637a448143425d03ac9a202bd0b3260826cbc6dce85c7e9b9381bdacb8c57d711af5d61c766b900cce6c
SSDEEP 786432:UqsjvUsvRjAfHvoj7/B10GczN5xwcJXTpWgYVvPM96Rc:t2vU0RjyPoj7p10GuN5xrXTpW8L
TLSH
T1F9387C03E3A610ECC09DC2759B1A9526EEB2BC450735B6DF266467212F76FE06B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution hijackloader loader persistence spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\KuxionPort
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral3/files/0x001900000002b35e-26.dat	family_hijackloader

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Grape.exe"	Grape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Grape.exe"	Grape.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\D:\	DriveCircuitry.exe
\??\F:\	DriveCircuitry.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5384 set thread context of 4020	5384	DriveCircuitry.exe	94
PID 5384 set thread context of 5416	5384	DriveCircuitry.exe	113
PID 5384 set thread context of 4020	5384	DriveCircuitry.exe	94
PID 5384 set thread context of 1652	5384	DriveCircuitry.exe	119

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	DriveCircuitry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DrosuraCloudlet.job	DriveCircuitry.exe

Executes dropped EXE 2 IoCs

pid	Process
5548	DriveCircuitry.exe
5384	DriveCircuitry.exe

Loads dropped DLL 6 IoCs

pid	Process
5548	DriveCircuitry.exe
5548	DriveCircuitry.exe
5548	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5392	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DriveCircuitry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DriveCircuitry.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriveCircuitry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriveCircuitry.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3648	chrome.exe
2844	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5384	DriveCircuitry.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3236	Grape.exe
3236	Grape.exe
3816	Grape.exe
3816	Grape.exe
5548	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
4020	chrome.exe
4020	chrome.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe
5384	DriveCircuitry.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5384	DriveCircuitry.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe
Token: SeDebugPrivilege	5384	DriveCircuitry.exe
Token: SeShutdownPrivilege	4020	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 1968	3536	Grape.exe	80
PID 3536 wrote to memory of 1968	3536	Grape.exe	80
PID 3536 wrote to memory of 3236	3536	Grape.exe	81
PID 868 wrote to memory of 2012	868	Grape.exe	85
PID 868 wrote to memory of 2012	868	Grape.exe	85
PID 868 wrote to memory of 3816	868	Grape.exe	87
PID 3536 wrote to memory of 5392	3536	Grape.exe	89
PID 5392 wrote to memory of 5548	5392	cmd.exe	91
PID 5548 wrote to memory of 5384	5548	DriveCircuitry.exe	92
PID 4020 wrote to memory of 4512	4020	chrome.exe	95
PID 4020 wrote to memory of 2864	4020	chrome.exe	97
PID 4020 wrote to memory of 3648	4020	chrome.exe	96
PID 4020 wrote to memory of 2864	4020	chrome.exe	97
PID 4020 wrote to memory of 1776	4020	chrome.exe	98
PID 4020 wrote to memory of 1776	4020	chrome.exe	98
PID 4020 wrote to memory of 6140	4020	chrome.exe	101
PID 4020 wrote to memory of 6140	4020	chrome.exe	101
PID 4020 wrote to memory of 5916	4020	chrome.exe	102
PID 4020 wrote to memory of 5916	4020	chrome.exe	102
PID 4020 wrote to memory of 5780	4020	chrome.exe	103
PID 4020 wrote to memory of 5780	4020	chrome.exe	103
PID 4020 wrote to memory of 1576	4020	chrome.exe	104
PID 4020 wrote to memory of 1576	4020	chrome.exe	104
PID 4020 wrote to memory of 5356	4020	chrome.exe	105
PID 4020 wrote to memory of 6072	4020	chrome.exe	106
PID 4020 wrote to memory of 6072	4020	chrome.exe	106
PID 4020 wrote to memory of 3516	4020	chrome.exe	108
PID 4020 wrote to memory of 3516	4020	chrome.exe	108
PID 4020 wrote to memory of 5516	4020	chrome.exe	109
PID 4020 wrote to memory of 5516	4020	chrome.exe	109
PID 4020 wrote to memory of 4936	4020	chrome.exe	110
PID 4020 wrote to memory of 4936	4020	chrome.exe	110
PID 4020 wrote to memory of 5160	4020	chrome.exe	111
PID 4020 wrote to memory of 5160	4020	chrome.exe	111
PID 5384 wrote to memory of 4020	5384	DriveCircuitry.exe	94
PID 5384 wrote to memory of 4020	5384	DriveCircuitry.exe	94
PID 5384 wrote to memory of 4020	5384	DriveCircuitry.exe	94
PID 5384 wrote to memory of 4020	5384	DriveCircuitry.exe	94
PID 5384 wrote to memory of 4020	5384	DriveCircuitry.exe	94
PID 5384 wrote to memory of 5416	5384	DriveCircuitry.exe	113
PID 5384 wrote to memory of 5416	5384	DriveCircuitry.exe	113
PID 5384 wrote to memory of 5416	5384	DriveCircuitry.exe	113
PID 5384 wrote to memory of 5416	5384	DriveCircuitry.exe	113
PID 5384 wrote to memory of 5416	5384	DriveCircuitry.exe	113
PID 5384 wrote to memory of 5416	5384	DriveCircuitry.exe	113
PID 4020 wrote to memory of 4068	4020	chrome.exe	115
PID 4020 wrote to memory of 5664	4020	chrome.exe	116
PID 4020 wrote to memory of 1872	4020	chrome.exe	117
PID 5384 wrote to memory of 4020	5384	DriveCircuitry.exe	94
PID 5384 wrote to memory of 4020	5384	DriveCircuitry.exe	94
PID 5384 wrote to memory of 4020	5384	DriveCircuitry.exe	94
PID 5384 wrote to memory of 4020	5384	DriveCircuitry.exe	94
PID 5384 wrote to memory of 4020	5384	DriveCircuitry.exe	94
PID 5384 wrote to memory of 1652	5384	DriveCircuitry.exe	119
PID 5384 wrote to memory of 1652	5384	DriveCircuitry.exe	119
PID 5384 wrote to memory of 1652	5384	DriveCircuitry.exe	119
PID 5384 wrote to memory of 1652	5384	DriveCircuitry.exe	119
PID 5384 wrote to memory of 1652	5384	DriveCircuitry.exe	119
PID 5384 wrote to memory of 1652	5384	DriveCircuitry.exe	119
PID 4020 wrote to memory of 2844	4020	chrome.exe	121
PID 3536 wrote to memory of 5872	3536	Grape.exe	122
PID 868 wrote to memory of 1604	868	Grape.exe	123
PID 4020 wrote to memory of 5748	4020	chrome.exe	124

C:\Users\Admin\AppData\Local\Temp\Grape.exe
"C:\Users\Admin\AppData\Local\Temp\Grape.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1804,230229683155696273,4043289029638146683,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1808 --ignored=" --type=renderer " /prefetch:2
  2⤵
  PID:1968
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=utility --field-trial-handle=1804,230229683155696273,4043289029638146683,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2184 /prefetch:8
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\1791140476080\DriveCircuitry.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Users\Admin\AppData\Local\Temp\1791140476080\DriveCircuitry.exe
    "C:\Users\Admin\AppData\Local\Temp\1791140476080\DriveCircuitry.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\ProgramData\KuxionPort\DriveCircuitry.exe
      C:\ProgramData\KuxionPort\DriveCircuitry.exe
      4⤵
      Enumerates connected drives
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Drops file in Windows directory
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5384
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1652
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1804,230229683155696273,4043289029638146683,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:5872

C:\Users\Admin\AppData\Local\Temp\Grape.exe
C:\Users\Admin\AppData\Local\Temp\Grape.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1840,5795270880387343750,14388534845429263043,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1852 --ignored=" --type=renderer " /prefetch:2
  2⤵
  PID:2012
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=utility --field-trial-handle=1840,5795270880387343750,14388534845429263043,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2180 /prefetch:8
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3816
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1840,5795270880387343750,14388534845429263043,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1008 /prefetch:2
  2⤵
  PID:1604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:5668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7a3ac728,0x7ffd7a3ac734,0x7ffd7a3ac740
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,17029711881077455839,10624046095371333645,524288 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,4912967379572785109,2681665778861459287,262144 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,4024108776019398364,402368463058382125,524288 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2852 /prefetch:13
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,10235835390902760891,18145552226075691921,2097152 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,17401412447528851226,6865202747560222213,2097152 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4592,i,6267553919523227621,8091106104187644075,2097152 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4752,i,17472379439347196046,4068347600051803016,524288 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4740 /prefetch:14
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,6912091068541911273,11052188424107205049,524288 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,781950272806790371,12651803722362907905,524288 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,392848550696552833,4732096609844710958,524288 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,10807342146836589600,8339179230667141455,524288 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6024,i,6835196781198523100,18394655771831964095,2097152 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5764,i,8731341870796330986,217500844256910300,2097152 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6036 /prefetch:9
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,8296200203876915173,15903767015007043264,524288 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,3114146328944616077,7646754679802793758,524288 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,3724961099340590677,6805943067190880025,524288 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,4111987644559958563,11314500917673836985,524288 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5412 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=872,i,12346117388684395754,11257086187944607760,262144 --field-trial-handle=2044,i,14676948354153720686,2567772925567100496,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1084 /prefetch:10
  2⤵
  PID:5748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

026b7998ee6e64ffa32541b4f736c9d77aea5529

Path C:\ProgramData\Gebilaxu\Heleru\026b7998ee6e64ffa32541b4f736c9d77aea5529
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

289c3f25-f556-40d5-bcb7-1fea151aad21.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\289c3f25-f556-40d5-bcb7-1fea151aad21.tmp
Size 264KB
SHA256 b2759fc3a8235f3d0b3857c773f797d2fd66d18d32041c5e28bd9cc15542d50f
MD5 8741bbbfabcd6cc5b054ca9f169e4686
SHA1 f91f34b24ea81cbdbb17e6ea0e7c066d11aaf1d6
SHA512 84c3dac973db60c7dcdce1c64e072dd1dddc0f087e7c3bb14bd528f5c36b71d449cbb1a330e9f22d939ffeb0e6d474229662308e66c6826f9d575754e363cffe
SSDEEP 6144:a/nNb30A1kekNShdDABY2t4fLJ0L6nGJxi3bzqapJjV:aPNb30YFqWXUx8zvpJB
TLSH
T1D1441261A3B0BD3DC7B3EF41457A2E184E73C9C3494AFD2986D9CE2407CDA550A26DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5678061a-f12a-4039-a02a-4997e38d1848.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5678061a-f12a-4039-a02a-4997e38d1848.tmp
Size 265KB
SHA256 266f70d866e82837fa4b1c9bfeef7d954d5dbe37b152def97a566520fd1ce8c5
MD5 12b460cb9686191e9aa9809b7b62f052
SHA1 d6aaf5335c0327234a3287b0c52ed0e1e21cc6ec
SHA512 cede0792d8d845bc868a6074e7b97a0fa0f98ee61cf228bf1a1a04d3c6939f54cf6b16bcd7d9bb08b9668087c60c678a2cc4571dde2d055e15671c77bf3998cd
SSDEEP 6144:nnNb30A1kekNShdDABY2t4fLJ0L6nGJxi3bzqapJjV:nNb30YFqWXUx8zvpJB
TLSH
T1AA441271A3B0BD2D87B3EE41047A6F184D73D9C34D0AFE2986D9CF2406CDA550A26DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03ab5c89-7078-4b4b-b2d7-8e0bc053b994.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\03ab5c89-7078-4b4b-b2d7-8e0bc053b994.tmp
Size 13KB
SHA256 9a718222eff85bd02a8a52d640a2de3dc252f972008e30b4b155f57b03a85df3
MD5 7c9ebb27b80ec8e63016cb884597fca6
SHA1 157f6032a4d2ec3ec672a0e4f2273cf82b74c5bd
SHA512 cb329c8883491fe6f3f5484faad9136f27a331e4b080a720bcaedfa41ab697038b5cb1b46eb793336176d841c209e5c2c4feca63aef4fb865fc88654f64d59ed
SSDEEP 384:hzjdQ7KxkXqKf/pUZNCgVLH2HfgslgSXODdQ+ErU3MjHGIqIkJT:h/dQ7KxkXqKf/pUZNCgVLH2Hfgs+AOJ/
TLSH
T1D2520A67588D9A3F0FD8D54DDC167F4FACB6025662A84D2893FF9C1803967CB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ecb734a-f577-44ce-9f7e-525dc292acac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3ecb734a-f577-44ce-9f7e-525dc292acac.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

63af6aa9-ff6a-4731-bc0f-bad51169876b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\63af6aa9-ff6a-4731-bc0f-bad51169876b.tmp
Size 12KB
SHA256 4dd2e331a69cae4ab2cebe1cd1138ca45185c475cf6980c21fe7349f1acc6ff7
MD5 01a8e7602119276124ea6868c811632e
SHA1 53c217656549aff65628920438e57a6708d377de
SHA512 ef3881c31974652375020490eb1ad430123ff8c519e8042c8d62924dc39bdf9d91023399b3406403fb8a50ad9d10865904b2f40ad1e32e131ffd8faf4377936a
SSDEEP 192:kRKMq5xAv7xprPRp1N9qHsb+WNnNi0Fye+26AbwVyIsnAUgE:kRbqbc1pXjsw4002CE
TLSH
T19142B32EAD14797B5CDBD22AFA657B53E2F1102221943E84EAFCC93C25E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 16KB
SHA256 71807a9dfcc3dd53751f50464eb0598ae2fb020eaa4fba23b8a1ea8f7865f661
MD5 2be2ddc8292b95f1a7dd02ac42a7d8b4
SHA1 2afc0f200f89fe62096b96698d3c8d2bfc4a883a
SHA512 e57b6978d6458dffcf15c1ec6c32bac33fef0144aae5fd03e607786ec14b379f25523daaa607784799c0a6aa93b5b5d303bf7feab0f31e50016621c03b4f715b
SSDEEP 3:OlH/l0NXzbIhl/0vE1Xam4/rXEHsqK1caaulx0HaHO4jylwXadP/lEtaUFuHsqKg:KmNn1vOsrEKy6tjawmEtaUUf
TLSH
T1057217DAA29A2400C0E3E2FEDA22E2A253026A189398CF01E6494EF091206441EF91CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log
Size 95B
SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
MD5 021b8d293c14358bb37b18ba45792aa5
SHA1 22e73b3a1d152734191bf7de9472a54be346b706
SHA512 ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG
Size 314B
SHA256 d7c9bc5491aa912df576a954296a2df0491b0ade6c8afc8f62b4d1044bfbd6ca
MD5 bfc5df81629280939d02c37f68febd5c
SHA1 ce9bd93814ce12c11a6616c5130beff1ffb5cb9e
SHA512 9086b68cc75827d0810c3cbe50a530c17754accf5c7aa2d54966d5f31c1ca2e09096abdc8ae1d0cd3473e3fbe19c36f7235fccf087de416b1e2dd60cf7597f10
TLSH
T1C1E086D5248ACA6E1459D05793A8EB9DCBE0350EE7D43406774DD550318A50CF2F0270
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG
Size 324B
SHA256 919ce7ac28536f101290460f6a89f7a8b76319f126284aa529880fe0b3651500
MD5 e4596db9428112d66d52797aedc0567c
SHA1 a6a5d6656e368039ce56c07d0b6098b5042822ed
SHA512 e87f37634d1df9bce2c78ec52f6a592f6369f665430cf22b8da3486ea5109f16ed32c91a0da77184cf5a5c0ff91860bf8fe60c43eb7f8d27a7533b830b535740
TLSH
T113E086D8288AD36D1959C46753B9F34E8BE03509B6D47C067745CE40318F606F1F1770
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 ecde28a5320a37d05fbfaaa977d077cc0a64bc3425466b3ad997c274db5054b8
MD5 8a66044b1b14bf2a8e8f35730c7a99c6
SHA1 5e4ac2f247818418d9dea3f3e6383c359d846214
SHA512 7aa962202fc89148905a925fdc2a21c749c16a7d37ba469ef5aef262272388a95b4317ad4a4cd4d6ef5f4fbed2a2b0af7f92bb3961e6d358b859252ef778ce1a
TLSH
T11BE086D4288EC22E645AD46743E8638D8FE03408ABD83C062B49D854338B908F1D02B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 1KB
SHA256 06bfc43cf5b65981bdca7e011852aa2b30247610a95e8e4f0d4c36260e244b38
MD5 b6b298c205a55ee6ea59df68432765ee
SHA1 e4f9c612db4c367bba8c742d472a95209553081d
SHA512 cae2e44d1419a8eec1a08f4fd2dc3bfe4e4d7541912c8d2917d474f336f344af38cb13549a88fbbd978e3b516df1fec4d3bec2117902ea34aa63e6d87b3c01ba
TLSH
T1342121886B81A387DAB78E7B1C9193523EB1519193B91DD753F88C317CCAAB163170C5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 308B
SHA256 90c94f865f16d95b063804e80a0bf6008e514f026b17faa1feea3fd3522f72a6
MD5 279fd44fb5ca65b21cac0604385a6999
SHA1 e0cef256487e79d3240f12e1043276865baa3f8b
SHA512 642922e59e534a0144e4a3078efff090a7db79002b38c0e5f9918d82e1057a3d1b3982eb4681f4d8e6c6150d3f68235e72b776969092d227b155ee80824a7d8d
TLSH
T158E0CDE974EAC72E29498013136CA38DCBE4FD49D6E934466700F44471CE404F1E5671
MD5 SHA1 SHA512 TLSH

Submit Download

06457069-7a34-419c-b18a-db20bcd36cac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\06457069-7a34-419c-b18a-db20bcd36cac.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

08272833-8099-4603-8a9a-dd1b6ef100cb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\08272833-8099-4603-8a9a-dd1b6ef100cb.tmp
Size 2KB
SHA256 9de4359879604e5c72ef7662878790755ee916c1fe917bf8363bd38bfac26518
MD5 dd14b379308f8c4e8b4a74d2f3523193
SHA1 ea7acc0c62df570b18ce986ad795b5b46c36bd83
SHA512 fa100246a3093f8a607e514872a078316a842bc489377d0d6f42abd8f6875add2844b81ad225eb3540d14a34b3562d588a3d5fc25cffd74bd3a6d2645ef1d1ab
TLSH
T15C518AF3C7D88A6DC41156F49B216E1FCD3D0A18121D3C62D8D8EE5B53E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 6ef4eea69bc1f1d57962e0def40f8ca962d2ba11b71b4e162302edba83e9853f
MD5 8d4724b1e2eb1396335fb817fa76446b
SHA1 b7e732f20c89d7456b75a2ec28f660761d4d770c
SHA512 c64dc91b020d057b4c53f59460d802f33080cead27d1e07b886eaf762ae07a0b627988f5dc2bec46918aff5bb54ea520c893a1bf29845cd7ad1e2bde238efe8c
SSDEEP 48:TqIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoO/:+IEumQv8m1ccnvS6uG
TLSH
T131F2F1FF07197501C0E49674D6810ECFFD2D051D4B9BBEC09AAC09F3AB865E39538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 99a2e4fb6095534d397cb4a45ea8ae828586399143bf858ae9918529e676cb07
MD5 ab004484e25d9009f6d4bca4300eed7d
SHA1 dfa7971038a2c55d02f463795be8a8c3306bc80f
SHA512 465ebe18432e1944696898d3e161de107aa2399a971f911768cfe8a1f1591f673a7507a8ce4bf653256e531ec766c0758be881c5d536f7d31a5a51ac41976b08
SSDEEP 384:hzjdQ7KxkXqKf/pUZNCgVLH2HfgslgSXODdQ+ErU3MjHGRqIpJ9Y:h/dQ7KxkXqKf/pUZNCgVLH2Hfgs+AOJY
TLSH
T1BD52F967588D9A3F0FD8D54DDC167F4FACB6025662A84D2893FF9C1803967CB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 270B
SHA256 3530055a62ddc24a89dd97751ac9db187d009eb8193a29a3636cae2567d4a4cd
MD5 70ef71dd0fed6c14b2b6e149267a2c2a
SHA1 b8829ea9631cd5e0aba87d81e71047ef5fa92f24
SHA512 2ed43127bcd5443c4cd04a01f70de06c50fcef1f284ee4dfec07e605133aa5cd6a1e197dbc0c6e73679af491b976a7304e8d38d58c948cb55471399978470241
TLSH
T1F3D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 320B
SHA256 b61cc77e31d0fa7a4129b8b23fbdd434151a47b83aa2df4a35ef9f91e8513bcb
MD5 5e75b2e4d254cc23018580d9500c92a7
SHA1 f01b4dae288c6a79deb7e7b89b712def067e55dd
SHA512 9d0907473bbafa84cfeb85711f6d52cb4a46ac5816a7264d12f4a9d5916ed138413a5f1f60ccab614ff4647a627bcbeef79f4e482850e39b76cf7e4f49f6daad
TLSH
T1DDE08CE524CAC32E159D902703F8B34E8FF13408EBE828062B16D558378F808F2D0AB0
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13435614090352766

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13435614090352766
Size 2KB
SHA256 dcfb48ddcc37fbfc444e953a406deacc3af2059838914d09303fb3bf36f838fd
MD5 5f02d89b153312aede55eeb0415930cd
SHA1 4ba203cac0e54159861443ee6310d067ab4b7b24
SHA512 600c5db5355dffd387863407674161ea6c71e4efa368f66f792b30f6daa8ad3a7a23abba1e10f4a945a1dc11a3ed622c4eb20ff3274685d0a637a58306b325f2
TLSH
T1EA51B02657F2013EE77F8479817611DEEE35B912384A8E1FA0E112100CA3E432FA5DEE
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 b065e00230663c0d8ae5c68384710d306c9f5276be84de75979febc1f46ddb61
MD5 92fa8dcd210dfb2def83b8963fbed521
SHA1 e119db1af2a1b27b8ee3855dbb99e0ead9d98b78
SHA512 1b31cda68d68ff5aba2b95f2d1319df756e1064f9eb9da5ca71b4cdf9afd2b60b816bb39c7252a3ea7f0c7dd4e5f42d987cbd7070f17cce80b62a08b25a9e915
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 283250fde4bf97b657bb1ef5dc1b73ff4745375e322e5bed7aef5a06ff1600ec
MD5 6286532ff4c23bf5821ac8696c755475
SHA1 c8b45991f298a035d0241b644d3eacb72829c9c8
SHA512 2006d8ba015bced63e24da5a2adacaa843e3e9fde676f496a62e8ae0f4c90532a2876c07b27b855204e4e5d1e9d279c40078be527d460abe57ea6ed36fb28ddb
TLSH
T1F5A002118DD51611DD2D97767061568D27A159FC1D619303A4915547FCAF5D14303201
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a338de4a-32c0-414d-af7e-44e77be95560.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a338de4a-32c0-414d-af7e-44e77be95560.tmp
Size 649B
SHA256 d01b4ff03271561097e820e48e6299e133ab489c0e4df8a3df66612e5f42c089
MD5 c9d979f0ef3b9273681f1e26245d4073
SHA1 d9d42edccccf71c95caa11f68734117ae911341e
SHA512 3cad83622bb3cbb8e3dffa7bc61047179d9f33bec30f5c8fae549873b0bca194255f9989326c2091a64922990f868a549ffba3b4e9af8468501e8b15d4df1600
TLSH
T1B0F078B5CC22EC3708FD1B6820980B47E751131B2B40888F3E3D851C8FB573B058582C
MD5 SHA1 SHA512 TLSH

Submit Download

d74d715b-c56a-4139-9007-c8f9f6f91801.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d74d715b-c56a-4139-9007-c8f9f6f91801.tmp
Size 11KB
SHA256 b8857870d1df011faf521dc30a022c2e0629b43576cef466a72192df4bd3aad3
MD5 11ec6d1e2ed37822f8a0f24e7e373d4b
SHA1 64fd10aa519b0fdc2437f9eaaf885ad3d50205f8
SHA512 0d29c054e94043c3e1f3c9eca07b425685e52727037b4fa5b9ff7eff4774a1b75c190be2dc3aca765082f39dcd3b2ff571a457e4d1c07eb8907eec126d83c250
SSDEEP 192:kRKMq5xAv7xpAPRp2N9qHsb+WNnNi0gye+26MbwVyIsnAUge:kRbqbc1UXusw40P2Ae
TLSH
T14432912EAE14757B5CDBD22AFA667753D2F6102221943E84EAF8C93C24D75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

bc2dce28-9c1e-4951-99ba-956d9bb0c588.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bc2dce28-9c1e-4951-99ba-956d9bb0c588.tmp
Size 264KB
SHA256 1eb0daa9e3d976fb905a400e22302aa36035e83ee0b10665a15b46674db134b8
MD5 f737f45e76b5844c6c443608c9dfdef5
SHA1 01e1b3e9a8e1d1b6c37a2a46c3253bda1e63dca9
SHA512 c3b428ab5a8809591f814f61d42be246645c1ac025c71a74b6aec01af78d617b6afcf54ce1817629ba36275831c803593c5b3fe0f2ebc10599b9e561b0006bb8
SSDEEP 6144:l/nNb30A1kekNShdDABY2t4fLJ0L6nGJxi3bzqapJjV:lPNb30YFqWXUx8zvpJB
TLSH
T152441261A3B0BD3DC3B3EF41457A2E184E73C9C3494AFD2986D9CE2407CDA550A26DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c03a88cc-5254-4d24-80f1-ed5011c5ea54.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c03a88cc-5254-4d24-80f1-ed5011c5ea54.tmp
Size 130KB
SHA256 74ddafcec9fe66a67269f69ed17239f5f2bf70fca4ea61efa071582338bbf2de
MD5 afa2415e284166e63fc9b39b3a0a6f78
SHA1 4c507b7b03487a1371dac55923e81c364dc89fa3
SHA512 9595df1c769554bb00f5eb027cb49fed3cbde8e03e270918f88b2ea0bbecee0d5ef77b8dcc79afa2ae6df137ecf4fa64a773daa92407809d01c72aa8f78e58c1
SSDEEP 3072:SH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjt:Ct4fLJ0L6nGJxi3bzqapJjt
TLSH
T117D302F0C2A0AC7ACBFBEE4145755E948E71D5C689CDBE2405F98C1806CEA354E17EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriveCircuitry.exe

Path C:\Users\Admin\AppData\Local\Temp\1791140476080\DriveCircuitry.exe
Size 1.7MB
SHA256 399d07658c7d30dffb42b1e4b83904f5334a93cfb71f2516d5161d4cb4930c16
MD5 05b04eebdcedce5555b1e2d225c54c3b
SHA1 90d21f29df7f288d5711503cc00c4b6dae9db8d8
SHA512 971cf26a26b32e3d250255e50bc754cae545894b7e479378399a211c94bdf9d2cdfc23965a1875f1a5a201f01cc2b3c7c056f7103c9b76b0423ad8b25d1bca44
SSDEEP 24576:uip+eMB5CzFwhStFNEWwerW16DWpt8gd5rjNPyeDh0lhSMXlumm8KytGn:xMB2FAStFqff/8gL5yW8K+Gn
TLSH
T1CF858D317105C036E69212F1986EAFAE969C9E340BF658D7A3C43F6E59301C37B35A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

covrun32.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140476080\covrun32.dll
Size 1.2MB
SHA256 b52469ae233c5e8333e9e4d0304abafcdd3ca230fd0d4746148048a84a8a74c7
MD5 2c3247955a9517f1e31c6fe573c13007
SHA1 db5c2837788d312b39edeb497416df1c3e964a4a
SHA512 e32f44146ee304969c2c58c96e22491028610da21fb50ac6c0a5ad523d26912fafe4f03f109a6275cf447f73f082ad3129c1e0ec747ef055987ad325e69682a5
SSDEEP 24576:zvgVx+HPPKiqF9RXI/Nco6Y8XqyVHNotKhuR79jdt7Okaw9AYe3wzpBLnm2Wnj/6:jzHaiqF9R4FcYyqyVHNotKsvjdhOS9Am
TLSH
T1774529113295F025ED7D3E71183BEAAB5EFDBA613B7080FB53846A5B58206C1DE30E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord-rpc.x86.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140476080\discord-rpc.x86.dll
Size 580KB
SHA256 93541ae3a14cfdb5bbc2f33abe9d742ae28a6e2873b20e0bc18b9ff71a5e8e5e
MD5 00172a5a5fb1798968d10759cd242dc9
SHA1 ad75f873dcb0ae0ede9aa21c9168f2c8a9b1a718
SHA512 b85fa26cb094e038335e29f15aef4505311a804755c6ec6d70f593831259e9f1028447b7d4324c0c721fce7d77d6f6b62594987169045d8f10a5a646a75581e8
SSDEEP 6144:RWzsNrb2/twRx2ax9L66vBvOz+f8uOU3g86oxaeZnyHuKfILz4ta+b:RuqHKtEkaxcuBvm+fnZcuKfIP+
TLSH
T1ABC46D51B4808271ECE621BA82ECB63642BDE4F007146ADB5BD80BFFE7605D1AF32557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140476080\msvcp_win.dll
Size 493KB
SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 7762c51ea02eb943183d597ea0ee5530
SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
TLSH
T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registry-def.ini

Path C:\Users\Admin\AppData\Local\Temp\1791140476080\registry-def.ini
Size 22KB
SHA256 02baffa1b00f467ed73a995895f2fa3459fd1868fb1e13b9fbcfc6138d5e1ea3
MD5 99273bfc4bd985f5ba7311468675c127
SHA1 2e47c838913c28b4bd43e14f3b6b89798fc81a11
SHA512 c6c2f4498cd0effe0fc9394a7e3714f96fc6fd8e722d812c8add09cc2140ff4f7593ae718ce6a74ab7db6b938a4bae2b3af3efd8fc0224030b0cacf6722232cc
SSDEEP 384:ghxuq36riGxgbzL783C0hdxNcmIyiAcp/uIikOxEPGEIdOm9tb5YVQJv0mriWHLZ:dW6rlgbrUtooI9EEP9Iwm97YVQJv0iH1
TLSH
T1B0A29FF59D45B1B1F81AAC76A51886B3D710FCB4B92A00A3EFE514473C195FADB20D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140476080\steam_api.dll
Size 247KB
SHA256 9848b113a4cbbe430246bb87063cd3b9d65ae5f404a37adf9f9f03dfedc42fb7
MD5 442e3bd0b03314e819e0476e4e232a6f
SHA1 f8cb81fb6729dc7ab8b3f9ce06340508902b9265
SHA512 2e9eae049dc5987edc10bb669c9183a69817b29018c66116a59b00288760995a3820d08a5ea19952a001fbdc1f981d2bef56af3e28c480aceaaa8de9de140a14
SSDEEP 6144:eisYZCtnsm/LnKNtYMHGAIk9DRFjsylO2Cu2V6U:FsWCtnsm/Lit7mArQys2CZ6U
TLSH
T1CC44373538A149B1E5B581358AB8DE2F3AEC216B37342CFF634806B5C8635C35A3759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tracker_spec.pdb

Path C:\Users\Admin\AppData\Local\Temp\1791140476080\tracker_spec.pdb
Size 5.0MB
SHA256 0ddd4ad7b286d9a355c0cc7cd23cdece201e86cddd662b1e3fe7633b5202d0f9
MD5 d54e12892efffbe393910bd783728d60
SHA1 010851ac60da08c74ff1ec385aea908beb242045
SHA512 9d24d03fd4d9ba84316bdac4cba98493f72cc3dde6c16d51ad4d1273c23d1ab8b9223fc859a2ce9e5cf1371670accd395f61e0800f5796261f9484674acb301f
SSDEEP 98304:n2mlo7tPINolO4LRkit8cj2ah1Bzx2d/6vUV3R9WyMPvOxH/:do7tP+olMpciSBI6vUV3RcTv0
TLSH
T1E036231471E2593BE827AF01805B931AB2953DA8B215E3B260D775FF37395E8460EFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140476080\ucrtbase.dll
Size 1.1MB
SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 c4a25dce665733663284750666684703
SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
TLSH
T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

268c2dac-854a-435d-9f73-921eaad5886c.tmp

Path C:\Users\Admin\AppData\Local\Temp\268c2dac-854a-435d-9f73-921eaad5886c.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\QqSRW\YZw7pZ0\Default\YiKZeVga\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nBW2.7z

Path C:\Users\Admin\AppData\Local\Temp\nBW2.7z
Size 18KB
SHA256 9d9882dc51add027d242fcd52f1017503e228d89894518950fbf5b703ab254e6
MD5 a887e5c18dc1227ca36328ead0adfd91
SHA1 b6b617e84613fb8cf322776c707b7281602ed61e
SHA512 cb657bcf0fc414a2ca957ea940036b39e9e2bda37bb8337dc7c724091b58c0bc394e2e7e11363a699e9491eec25721f2a37754b9c49e9e7ca82caa33963f150f
SSDEEP 384:A7aK8pV3aWtlMIctvCCsWpQ5L0EGwzjWaiIsA5YU2MXQOcgw0:PT3aWt4QCsLF0E7HWaWUnnf
TLSH
T15D92D019CB6FE441711202F940FB29CB1D0B54A72AAFE5E221E35C68765E8707D8EF92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4020_561735829\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

daemon.log

Path C:\Users\Admin\AppData\Roaming\daemon.log
Size 8B
SHA256 4bd5e45ecc06b4ee52ac9b9a8bcbdcbcfef405aff54aa4068520123eef667797
MD5 02e6da87034c40cfe79d312e5043968a
SHA1 d520a0bfc124f1a27a5b24a6392d44b3829335e2
SHA512 85e336ede232395ef9f5d06655ce81e49eba4c6604e37cf6c54a01981209e2407fa98ce143fbe3cbc41d6f10ad001944ef4b3bbd94fa02f7d761f97451de4d6a
MD5 SHA1 SHA512

Submit Download

memory/1968-3-0x00007FFD9AD30000-0x00007FFD9AD31000-memory.dmp

Download

memory/1968-63-0x0000020DBB6A0000-0x0000020DBBE7A000-memory.dmp

Download

memory/2012-64-0x000001B8C2AC0000-0x000001B8C329A000-memory.dmp

Download

memory/5384-50-0x00000000759B0000-0x0000000075AA0000-memory.dmp

Download

memory/5384-51-0x00007FFD9BCC0000-0x00007FFD9BEC9000-memory.dmp

Download

memory/5384-53-0x00000000759B0000-0x0000000075AA0000-memory.dmp

Download

memory/5384-55-0x00000000759B0000-0x0000000075AA0000-memory.dmp

Download

memory/5384-56-0x0000000074390000-0x0000000074CB1000-memory.dmp

Download

memory/5384-61-0x0000000074390000-0x0000000074CB1000-memory.dmp

Download

memory/5384-62-0x0000000074390000-0x0000000074CB1000-memory.dmp

Download

memory/5384-71-0x0000000074390000-0x0000000074CB1000-memory.dmp

Download

memory/5548-27-0x0000000075630000-0x0000000075720000-memory.dmp

Download

memory/5548-28-0x00007FFD9BCC0000-0x00007FFD9BEC9000-memory.dmp

Download