hijackloader | 04b9cce52af1b7ff4f52a2ccf69deb161fef821acc61aa12c3866f2885263297

Resubmissions

04/10/2026, 19:00

261004-xn51fazvev10

04/10/2026, 18:57

261004-xmfddszvct10

Analysis

max time kernel
151s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/10/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Grape.exe
Size 99.7MB
Sample261004-xmfddszvct
SHA256 04b9cce52af1b7ff4f52a2ccf69deb161fef821acc61aa12c3866f2885263297
MD5 4c56b85558e7aba7dfdf492564837779
SHA1 1961dbf19dda3d825cfc4899ea0f0efcd31fdb80
SHA512 4e3f91922f2d12c2bf9c78ffc9572aa3a3202e40c27b637a448143425d03ac9a202bd0b3260826cbc6dce85c7e9b9381bdacb8c57d711af5d61c766b900cce6c
SSDEEP 786432:UqsjvUsvRjAfHvoj7/B10GczN5xwcJXTpWgYVvPM96Rc:t2vU0RjyPoj7p10GuN5xrXTpW8L
TLSH
T1F9387C03E3A610ECC09DC2759B1A9526EEB2BC450735B6DF266467212F76FE06B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution hijackloader loader persistence spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\KuxionPort
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral4/files/0x000c00000001c651-26.dat	family_hijackloader

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Grape.exe"	Grape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Grape.exe"	Grape.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\E:\	DriveCircuitry.exe
\??\F:\	DriveCircuitry.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5964 set thread context of 5392	5964	DriveCircuitry.exe	104
PID 5964 set thread context of 2032	5964	DriveCircuitry.exe	133
PID 5964 set thread context of 5392	5964	DriveCircuitry.exe	104
PID 5964 set thread context of 7004	5964	DriveCircuitry.exe	140

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\NOTICE.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	DriveCircuitry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DrosuraCloudlet.job	DriveCircuitry.exe

Executes dropped EXE 2 IoCs

pid	Process
4884	DriveCircuitry.exe
5964	DriveCircuitry.exe

Loads dropped DLL 6 IoCs

pid	Process
4884	DriveCircuitry.exe
4884	DriveCircuitry.exe
4884	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5156	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DriveCircuitry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DriveCircuitry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriveCircuitry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriveCircuitry.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4584	chrome.exe
6460	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5964	DriveCircuitry.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6128	Grape.exe
6128	Grape.exe
2620	Grape.exe
2620	Grape.exe
4884	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5392	chrome.exe
5392	chrome.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5964	DriveCircuitry.exe
5392	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5964	DriveCircuitry.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeDebugPrivilege	5964	DriveCircuitry.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4196	5064	Grape.exe	89
PID 5064 wrote to memory of 4196	5064	Grape.exe	89
PID 5064 wrote to memory of 6128	5064	Grape.exe	92
PID 2020 wrote to memory of 5576	2020	Grape.exe	94
PID 2020 wrote to memory of 5576	2020	Grape.exe	94
PID 2020 wrote to memory of 2620	2020	Grape.exe	95
PID 5064 wrote to memory of 5156	5064	Grape.exe	97
PID 5156 wrote to memory of 4884	5156	cmd.exe	99
PID 4884 wrote to memory of 5964	4884	DriveCircuitry.exe	100
PID 5392 wrote to memory of 6072	5392	chrome.exe	105
PID 5392 wrote to memory of 4288	5392	chrome.exe	107
PID 5392 wrote to memory of 4584	5392	chrome.exe	106
PID 5392 wrote to memory of 4288	5392	chrome.exe	107
PID 5392 wrote to memory of 4360	5392	chrome.exe	108
PID 5392 wrote to memory of 4360	5392	chrome.exe	108
PID 5392 wrote to memory of 5760	5392	chrome.exe	110
PID 5392 wrote to memory of 5760	5392	chrome.exe	110
PID 5392 wrote to memory of 3176	5392	chrome.exe	111
PID 5392 wrote to memory of 3176	5392	chrome.exe	111
PID 5392 wrote to memory of 1108	5392	chrome.exe	112
PID 5392 wrote to memory of 1108	5392	chrome.exe	112
PID 5392 wrote to memory of 2908	5392	chrome.exe	113
PID 5392 wrote to memory of 2908	5392	chrome.exe	113
PID 5392 wrote to memory of 2360	5392	chrome.exe	114
PID 5964 wrote to memory of 5392	5964	DriveCircuitry.exe	104
PID 5964 wrote to memory of 5392	5964	DriveCircuitry.exe	104
PID 5964 wrote to memory of 5392	5964	DriveCircuitry.exe	104
PID 5964 wrote to memory of 5392	5964	DriveCircuitry.exe	104
PID 5964 wrote to memory of 5392	5964	DriveCircuitry.exe	104
PID 5392 wrote to memory of 1852	5392	chrome.exe	116
PID 5392 wrote to memory of 3828	5392	chrome.exe	117
PID 5392 wrote to memory of 3828	5392	chrome.exe	117
PID 5392 wrote to memory of 1852	5392	chrome.exe	116
PID 5392 wrote to memory of 6540	5392	chrome.exe	122
PID 5392 wrote to memory of 6536	5392	chrome.exe	121
PID 5392 wrote to memory of 6540	5392	chrome.exe	122
PID 5392 wrote to memory of 6552	5392	chrome.exe	123
PID 5392 wrote to memory of 6536	5392	chrome.exe	121
PID 5392 wrote to memory of 6552	5392	chrome.exe	123
PID 5392 wrote to memory of 6856	5392	chrome.exe	124
PID 5392 wrote to memory of 6864	5392	chrome.exe	125
PID 5392 wrote to memory of 6856	5392	chrome.exe	124
PID 5392 wrote to memory of 6872	5392	chrome.exe	126
PID 5392 wrote to memory of 6864	5392	chrome.exe	125
PID 5392 wrote to memory of 6872	5392	chrome.exe	126
PID 5392 wrote to memory of 7040	5392	chrome.exe	127
PID 5392 wrote to memory of 7040	5392	chrome.exe	127
PID 5392 wrote to memory of 2104	5392	chrome.exe	129
PID 5392 wrote to memory of 4064	5392	chrome.exe	130
PID 5392 wrote to memory of 2104	5392	chrome.exe	129
PID 5392 wrote to memory of 4064	5392	chrome.exe	130
PID 5392 wrote to memory of 6768	5392	chrome.exe	131
PID 5392 wrote to memory of 6768	5392	chrome.exe	131
PID 5392 wrote to memory of 1852	5392	chrome.exe	132
PID 5392 wrote to memory of 1852	5392	chrome.exe	132
PID 5964 wrote to memory of 2032	5964	DriveCircuitry.exe	133
PID 5964 wrote to memory of 2032	5964	DriveCircuitry.exe	133
PID 5964 wrote to memory of 2032	5964	DriveCircuitry.exe	133
PID 5964 wrote to memory of 2032	5964	DriveCircuitry.exe	133
PID 5964 wrote to memory of 2032	5964	DriveCircuitry.exe	133
PID 5964 wrote to memory of 2032	5964	DriveCircuitry.exe	133
PID 5964 wrote to memory of 5392	5964	DriveCircuitry.exe	104
PID 5964 wrote to memory of 5392	5964	DriveCircuitry.exe	104
PID 5964 wrote to memory of 5392	5964	DriveCircuitry.exe	104

C:\Users\Admin\AppData\Local\Temp\Grape.exe
"C:\Users\Admin\AppData\Local\Temp\Grape.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1768,13051813348381995960,17602347230633945132,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1776 --ignored=" --type=renderer " /prefetch:2
  2⤵
  PID:4196
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=utility --field-trial-handle=1768,13051813348381995960,17602347230633945132,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2144 /prefetch:8
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:6128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\1791140475681\DriveCircuitry.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Users\Admin\AppData\Local\Temp\1791140475681\DriveCircuitry.exe
    "C:\Users\Admin\AppData\Local\Temp\1791140475681\DriveCircuitry.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\ProgramData\KuxionPort\DriveCircuitry.exe
      C:\ProgramData\KuxionPort\DriveCircuitry.exe
      4⤵
      Enumerates connected drives
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Drops file in Windows directory
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5964
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2032
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:7004
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1768,13051813348381995960,17602347230633945132,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1220 /prefetch:2
  2⤵
  PID:6812

C:\Users\Admin\AppData\Local\Temp\Grape.exe
C:\Users\Admin\AppData\Local\Temp\Grape.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1784,8218085582764263432,2420609933457280304,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1796 --ignored=" --type=renderer " /prefetch:2
  2⤵
  PID:5576
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=utility --field-trial-handle=1784,8218085582764263432,2420609933457280304,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2224 /prefetch:8
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1784,8218085582764263432,2420609933457280304,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1268 /prefetch:2
  2⤵
  PID:6316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:3488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x104,0x108,0x134,0x7ffd4c72c728,0x7ffd4c72c734,0x7ffd4c72c740
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1868,i,12061287732273100081,14576256434710476801,524288 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,17054793539497231957,11366635026015294077,262144 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,9278875389948353889,3184526954731088630,524288 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:13
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,8768920456200886694,3932480859889108469,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,5459566799670891783,15966617487029663101,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4648,i,3180440816365954730,9167126313588581413,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,11477016431238348158,8562283914388465389,524288 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,5474289991080032511,17632957630865942244,524288 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5408,i,3618088008262290748,14277948563025655247,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5440,i,2400111976166543640,14770785059661183846,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5736,i,2191325777710582334,16842992835727536289,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:6536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,3578678492030892630,4743572697198873533,524288 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:6540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5500,i,607849317202048635,17777392399947361495,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:6552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6004,i,16206347537851187363,13976398468751491033,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:6856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,11389384703554463906,7542810711457376274,524288 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:6864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6068,i,15384646611460995143,3984419822720274058,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:6872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5652,i,9491444593596887314,16323228983769262011,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:7040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5868,i,16540535138340007799,12295731655164199598,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,13463672286063429914,8202581733117401282,524288 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5356,i,16619767419403690134,5242641701397206602,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:9
  2⤵
  PID:6768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6256,i,16548068643086802291,15302678508067810193,2097152 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,7328483937649285139,385940563092322498,524288 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:6736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,11062302593038427987,12891599871967359713,524288 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:6544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,2933182358501259648,1456843373672248456,524288 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:6604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1868,i,13338607200868668224,10831851177202737975,524288 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3240,i,14765691955005169907,16589504408281606804,262144 --field-trial-handle=1984,i,2548829446403055921,14901688998863435638,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:10
  2⤵
  PID:6980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2b9de3b49f4d95e0306211b11e627b02a22897ea

Path C:\ProgramData\Gebilaxu\Heleru\2b9de3b49f4d95e0306211b11e627b02a22897ea
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

8ec41572-799b-4441-b763-bf85755ad65c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8ec41572-799b-4441-b763-bf85755ad65c.tmp
Size 138KB
SHA256 88b930965d5aa98a9378967904b65071e845bc29365ec146fdb39ea85fe97168
MD5 8ebdc73a337a1b5d39adc1761a1c00a2
SHA1 2583634ef32e9ece00d5de1403a1a19dd5c70a60
SHA512 50fbe1b69031f11c3042767ce87646ef7560e3923f51593e285ae619d6bbf46cc4689aafb65ce3c3232339483916a6b5599fac475494be9a1e35e9062cbf95d2
SSDEEP 3072:mUzbnZnb316A1ZWXogZeyZHtzUOe+072J4341SABpyS:VnNb30A1kekNShdDABYS
TLSH
T118D3121537B8FE3D4272DB5548BB2E1E893388431807F8AED7CACF2917CD6891729859
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0da94994-6595-4b5b-ad38-1ec50e997c0b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0da94994-6595-4b5b-ad38-1ec50e997c0b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

3a2b7171-cf52-4aee-a1f8-4a59569d3c00.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3a2b7171-cf52-4aee-a1f8-4a59569d3c00.tmp
Size 10KB
SHA256 6a2ec642278ca6850596e1fefde8d560c77bf00e48cb622cca284ebda188b9dc
MD5 2c4141a3e1d59579b9fcf7d6a91940f9
SHA1 6b6f28226d5d2709f55ad2b45b63dd710de5b576
SHA512 2a4e5042da848c316346055ce7f9d63b46f1e912aae928284186386ff7360414336814b9973bdfed8ea4f6faccd0465eb48ec7b0e80a0d652427df4fcc91ba67
SSDEEP 192:PRBC+DuVv7xAPRp2s9xHsb+WNnkz0ao2Afkw2VyIsnAUgR:PRB9alYXrDwY0L2iuR
TLSH
T15732862AED60357F5CDAD22EFA217B53E7F5202121A02D84E6FC897C25E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

807d37ae-5115-4116-8652-c79f112a6e72.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\807d37ae-5115-4116-8652-c79f112a6e72.tmp
Size 11KB
SHA256 cfe51aa0a9f55e769784814c3af8d4f9910b0255575e2ed03b4ae0740caaa1a3
MD5 cd8b435ce9566e0b7fa087cb0b99a4ac
SHA1 2ba66f0c0a4f071d978015a55dad75365197d120
SHA512 51711ffdb716a4061ce568a13b975d8bad869ee30b7d4709cd987a0effd016e9febed6c9a69c1a65bbfa0e4b3e44e707902153b0717ab2b0703ea781434bc978
SSDEEP 192:PRBC+DuVv7xePRp0s9xHsb+WNnkz0Ro2Afkw+VyIsnAUgE:PRB9alCXNDwY0i2iWE
TLSH
T17D42852AED60797B5CDAD22EFA157B53E7F5202121A02E84EAFC897C25E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3697b3dfc7bdfbec14e0216b657152bcfdd0cc4e212f6bc6ac735d5d8a63a7b4
MD5 3f4d65a870ff4fb209d7988c50ac9645
SHA1 1cbff0e8d544c99472342e193f006bebe8d44bc2
SHA512 a0660c02ffd4911ef7adeb152b1e8920f672978e3585f946d2fe7d6e5ec97f7573c6436272892faac5b1c4e6cb45be7e7c284a270d48ddc77c2cf552b45e2bf8
TLSH
T1AEE02BE9CC25FC270AFC576D54600A46DA5003572B40598B367D81094FB177B014BC5C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 44KB
SHA256 f04a19dd62d878609b68a3c7c96d760ddb8d589295e03f47abccab7d962d676f
MD5 adcb7ed1ec22b4b18320b271dfa6f6ba
SHA1 cea663d45a989a561a79d11907377b8fb866c09d
SHA512 e1b16ba260a7e3fe1d035cfd779a060872ca8a903b688c38cb187fac81fa7ace012f12c33458a4e0a7e912bfff5345666dcf7551ccc6bebc60da0327b5fd6837
SSDEEP 48:9x+JqQq3qhmr/O43b/Y8uaLNW9WjWbfl4pwUdx+ndQmt1F:9xACEmrm43b/LuaLNW9WjWbflux+nd
TLSH
T10D1366068E286C66D2DBC2768CC24AE60F788B5C934B9F7419B804615D8170541BB4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log
Size 95B
SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
MD5 021b8d293c14358bb37b18ba45792aa5
SHA1 22e73b3a1d152734191bf7de9472a54be346b706
SHA512 ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG
Size 317B
SHA256 5b34a59d9d35c0ffd79f886601267906537ed42ee30bc76cf5c4b8ac79f49512
MD5 c4d34a23b30cd5fba18a932c1a90a4c2
SHA1 414838653ccb2bb9f5fb461693d467e36c9a1e5f
SHA512 80092dcd78935eb4a81e34cd9ab3af3a638f0f80998ba70bab9b42bee6130c606ccb46e00c2e78c863e85c5a6fbf3fac8fe62981c7198c5240ee927e3e65c775
TLSH
T143E086E535CAC22E2858F057D7B8A79ECBE6740CE7E834066759D4843289508F3D0274
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG
Size 321B
SHA256 c83133f43c9e7385bd3f95e4c7180e3bbbbd6500f4365eb083af4803aa9bd4fb
MD5 96e109bd8a12723c043ddb741ea87759
SHA1 e26995f3be7df174bb324ebf4bb5c90e6b3c0423
SHA512 4f158b428d53d10296894dd43749d74e573289f0405f70d3d97ae6715293f954d3fc893b2044da697c014756f66218071f5bd15303bad6985f04fad95cbc6fb1
TLSH
T113E086F8398AC22E2858A4578375B78E8BE67408A6E478066755DD9032CE518F7D0670
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 36a3e40411a6cc55e10a2ed83bf8519db16b41eee13448d519875e889a390d25
MD5 a4408f62702fae50aded331fe29f5aab
SHA1 8072977323a72562c35ae6415242e3131f6e1099
SHA512 9f88849a833d3006e949b4d6240bcb20a502e51c5405d768483494638d6f8c423da8a00bbac62d07feebaaffee97d3f3ca03be4ebe54482840f1e3cd86bbb742
TLSH
T1A2E086E4358EC72F5559846347AC634ECFE03518A6D438172B85D4803189D04F1D66B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 1KB
SHA256 a040a9960fddc0f40af327bc291f376477c4943175f99b6864e4537b7331ea73
MD5 248db8d8ea648592e61d86e88bd078da
SHA1 3e1eadf804ce62304ce0ebd6e0c57f02c8ded0dd
SHA512 af06994da98760cd9f0c31ca941ee2ce8bafa235a0b24f646a587b64288ea619c60558b4e95d8f57d1a4753c4294f10a69007b2f2e8effa4a2fa45e39e1f8374
TLSH
T11421308A0F55F293DB1BD97B5C49A3212E74E6B106A50887E3E4C8302CCEDB1610219E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 265B
SHA256 39dc70e309da1418519aba0af2f3a19d2f02350e15ef52f894f3820fc3b248df
MD5 ab1a20d03ebf4f5ead348417afa05ea9
SHA1 b6179b84375a6d4d5652c4e95fc1389b81f2e5c9
SHA512 b7c23fdec4f673dcfa6e55589868c7787c36a8f5c05b042c95565f7e28b8bde68a6658e5412d1e21e796f21e407a6335051e6f4104bcc2eb238dbe3c6627c8b7
TLSH
T1D8D02B4669D1C73F0388C5D70724A34ECFD82448DBE9264A4F10F80420CF80CE1D06B3
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

64b8d4be-b75e-494b-a109-ebcae94dfdc2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\64b8d4be-b75e-494b-a109-ebcae94dfdc2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

aada4c0b-9318-402e-88f8-3516521b28bd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\aada4c0b-9318-402e-88f8-3516521b28bd.tmp
Size 2KB
SHA256 f523cb3b9ca5bd229054b547dfe8042e8e07d5a811f12cec4459e347d505b05e
MD5 c6ab76be017cf21d5a8cefb3109e5c30
SHA1 a34d35dc2800b19d114e9192f6c4b0af8aa368b3
SHA512 2385ad4f5da463253db4a72e25bbddbcd78276cfab0f11d196e43e8266e7c037dab03b6c35f96c350cfcb4f17330f29ec682556521b2b07dc04d434542ddcde1
TLSH
T1C1518AF3C7D8867DC81166F59B256F1FCD3A0A18521D3C26C8D8AE5B53E28B2D25138E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 50a7de8403832ad4e71d31f7ded8c34399ea522f89bd6d49fa2b9cce744ed2df
MD5 2adb94feecc220fb08f8d93070412327
SHA1 4bbdc5ecfe4f36ec9ce3bed9c0477797f33adb4a
SHA512 14777f23dce12bbfe0ac8d65a6ba6b8e3d1279bb88eb7bc7fbfe0a1ad62b75fd330d432318e086971c60402c101e3b9191d3111a10f0bcf98e04383e4f895e0b
TLSH
T109A002115DC54611CD159776F26625496296587C1951C71396910444FD6B3D46715201
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 20ddaaf20875b4d1fb9a9d1c05a6092c6be98d185d7b5651ae0ffb849c7d88d2
MD5 4c69c0283676e8198cf73a2558110679
SHA1 3311c4dbc7c622ca79cdf50677cb78080e2950e0
SHA512 81901846d71355041887ddec7293e5ebc66b6b28500a374a9716a554e6f70e6668fbe3efff35ef3ae322ba98ff522f8c0b684c11cb414bdf3374cf188d5ff11d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

d88c9178-0453-479a-8c3d-66e84e476cb6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d88c9178-0453-479a-8c3d-66e84e476cb6.tmp
Size 11KB
SHA256 7991299d0778522386d8f1f85f67308a8218d66b167f81de8893dc52b4a822c3
MD5 8ba452d448274a189b9a9f74bf169f87
SHA1 2a9184a23aae846565056335f6a4aadcd351418b
SHA512 744fb6acfa8a316b7e7666b53662e7a1cc7208ed81857179fed99cda3d756ebc9b6cd6d0c5c73738ee12f0812deda490b08369af7e9d3d557151ce109805db17
SSDEEP 192:ezs4K6pN7KxkXqK4I40pUZNCgVLHrKHfFKslERbFXzKD/6N+ErUkKN9b7v+AN/Ps:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFb
TLSH
T1DA32E917A88D6E7F0FD8D50DCC166F8B6DB5029676680D2853FBAD0803A97CE114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heavy_ad_intervention_opt_out.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db
Size 16KB
SHA256 3f988de8cc924d73c7490c68529a8b25a9ca22f9578c594f554d1e06e0fac307
MD5 d3c18b5df876d89397c233263de4d4ee
SHA1 8ddc51297582d13332d57893a998f114ee504115
SHA512 9e4a3fd3819b6e9f1708f979fc9495fd1bdabc0e8d057767c4febc8fa855cc6e2e8d45c994e5c327ba87855a741034e2d71bacae23b2bc68cd0974eb1e7dafa0
SSDEEP 12:TLCewaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLvdBgtBgJBgQjiZS53uQFE27MCgGZsR
TLSH
T1FF72596D4D14B201C4BF9E75ACC1C0D23A2C712B0757B6E1A74023FF48AE032A5358A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 7c3e359922a38ef23ded6d2a78dc750f6dd9d90e382563d5dd8ddf3637d0c835
MD5 3dd4ca64e5fa9a21239191189a67dfda
SHA1 42ac566fd968ab55e1454996363c9635d5bd4b6b
SHA512 3c5052272557c2fee1c647533fd2cb3bc6ab103210cca91b66c4d06c4af195c3a585513911f87c07f80e13e65709d2d25dfbc974dd73bc6e270776b4b8949293
SSDEEP 3072:m5zbnZnb316A1ZWXogZeyZHtzUOe+072J4341SABpyS:KnNb30A1kekNShdDABYS
TLSH
T1FDD3121537B8FE3D4272DB5548BB2E1E893388431807F8AED7CACF2917CD6891729859
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

a008bff6-e4a9-47ff-a271-09126bd0f510.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a008bff6-e4a9-47ff-a271-09126bd0f510.tmp
Size 174KB
SHA256 5348c081d574078f08e13787cfdcdb9d4f475a0915255867b4588f0c779c2d93
MD5 d4a1d256cd7699eb1435d1f822e57a76
SHA1 fc511f2c2073990773df15ecaf608cbf164c8d7b
SHA512 fc2f81c5798ed769c6ab06f698a02da9b37a390dd95aadac31edbfc04683568beff8d6157fd14da57a8c1566fad3ebc4172f71ac85ac782cde00c4f6b4c2be3e
SSDEEP 3072:P952jI8DihZzbnZnb316A1ZWXogZeyZHtzUOe+072J4341SABpyS:/27D8ZnNb30A1kekNShdDABYS
TLSH
T1540412353BA4FE6C0672DA55407A6E1F0C61D9831E02FC5ECAC9CF360A8D58E5B3AD94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afb6f224-9212-4ac0-ab1b-1e3f8ce6d645.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\afb6f224-9212-4ac0-ab1b-1e3f8ce6d645.tmp
Size 138KB
SHA256 b9d14f7c3c7ca15110d5515413e6ed5e3db78d40f45e151e862aaf32930a0045
MD5 6177bf2a251f6ed9941d17df2864469d
SHA1 f37a6f2c2231e9ebd35299d2aaff9e0d92367dd1
SHA512 972f858e69049c8f6d6eccd231b24444e8f2cd98e2b0ca90fd8f85ff4145f40791dcd6498a7247292e1e3e1e84422a118afdbe59ee8f4c95460d684a702b5c76
SSDEEP 3072:P5zbnZnb316A1ZWXogZeyZHtzUOe+072J4341SABpyS:hnNb30A1kekNShdDABYS
TLSH
T164D3121537B8FE3D4272DB5548BB2E1E893388431807F86ED7CACF2917CD6891729859
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b50ef636-6a4d-49d1-a26d-9f9178024bc6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b50ef636-6a4d-49d1-a26d-9f9178024bc6.tmp
Size 4KB
SHA256 f4d90f472f04e6ad06578ecaf54976cfd73c7dacc22bdc569cc821ba404f11bd
MD5 01864b0618005e1489774be24ae76273
SHA1 22f3548aac2bc9fa3db03181d59f8fe102528077
SHA512 db4c7e8f2f484bdc982d1544162a5ccc0179480cf35e2ab87e4caedd46c7b23e018c921c43b11593c57908e196ff036caf1ffe2436b9db2e216b222747ea8e67
SSDEEP 96:fC0d+7N0X7jVYVfGTVnsERDotok5HVhDyB6FGyvoD3Emw2v+Tbv4v4a:fC0ESKkdDUDHjSBp4mwA+Tbvi
TLSH
T116A10731E8689C7B59FAD989B8432E43CEB8307BD562AE94F9DD4F0814E70EC1342567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15ea06d8-2fc2-4257-8898-afa56b6b54fd.tmp

Path C:\Users\Admin\AppData\Local\Temp\15ea06d8-2fc2-4257-8898-afa56b6b54fd.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriveCircuitry.exe

Path C:\Users\Admin\AppData\Local\Temp\1791140475681\DriveCircuitry.exe
Size 1.7MB
SHA256 399d07658c7d30dffb42b1e4b83904f5334a93cfb71f2516d5161d4cb4930c16
MD5 05b04eebdcedce5555b1e2d225c54c3b
SHA1 90d21f29df7f288d5711503cc00c4b6dae9db8d8
SHA512 971cf26a26b32e3d250255e50bc754cae545894b7e479378399a211c94bdf9d2cdfc23965a1875f1a5a201f01cc2b3c7c056f7103c9b76b0423ad8b25d1bca44
SSDEEP 24576:uip+eMB5CzFwhStFNEWwerW16DWpt8gd5rjNPyeDh0lhSMXlumm8KytGn:xMB2FAStFqff/8gL5yW8K+Gn
TLSH
T1CF858D317105C036E69212F1986EAFAE969C9E340BF658D7A3C43F6E59301C37B35A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

covrun32.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140475681\covrun32.dll
Size 1.2MB
SHA256 b52469ae233c5e8333e9e4d0304abafcdd3ca230fd0d4746148048a84a8a74c7
MD5 2c3247955a9517f1e31c6fe573c13007
SHA1 db5c2837788d312b39edeb497416df1c3e964a4a
SHA512 e32f44146ee304969c2c58c96e22491028610da21fb50ac6c0a5ad523d26912fafe4f03f109a6275cf447f73f082ad3129c1e0ec747ef055987ad325e69682a5
SSDEEP 24576:zvgVx+HPPKiqF9RXI/Nco6Y8XqyVHNotKhuR79jdt7Okaw9AYe3wzpBLnm2Wnj/6:jzHaiqF9R4FcYyqyVHNotKsvjdhOS9Am
TLSH
T1774529113295F025ED7D3E71183BEAAB5EFDBA613B7080FB53846A5B58206C1DE30E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord-rpc.x86.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140475681\discord-rpc.x86.dll
Size 580KB
SHA256 93541ae3a14cfdb5bbc2f33abe9d742ae28a6e2873b20e0bc18b9ff71a5e8e5e
MD5 00172a5a5fb1798968d10759cd242dc9
SHA1 ad75f873dcb0ae0ede9aa21c9168f2c8a9b1a718
SHA512 b85fa26cb094e038335e29f15aef4505311a804755c6ec6d70f593831259e9f1028447b7d4324c0c721fce7d77d6f6b62594987169045d8f10a5a646a75581e8
SSDEEP 6144:RWzsNrb2/twRx2ax9L66vBvOz+f8uOU3g86oxaeZnyHuKfILz4ta+b:RuqHKtEkaxcuBvm+fnZcuKfIP+
TLSH
T1ABC46D51B4808271ECE621BA82ECB63642BDE4F007146ADB5BD80BFFE7605D1AF32557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140475681\msvcp_win.dll
Size 493KB
SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 7762c51ea02eb943183d597ea0ee5530
SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
TLSH
T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registry-def.ini

Path C:\Users\Admin\AppData\Local\Temp\1791140475681\registry-def.ini
Size 22KB
SHA256 02baffa1b00f467ed73a995895f2fa3459fd1868fb1e13b9fbcfc6138d5e1ea3
MD5 99273bfc4bd985f5ba7311468675c127
SHA1 2e47c838913c28b4bd43e14f3b6b89798fc81a11
SHA512 c6c2f4498cd0effe0fc9394a7e3714f96fc6fd8e722d812c8add09cc2140ff4f7593ae718ce6a74ab7db6b938a4bae2b3af3efd8fc0224030b0cacf6722232cc
SSDEEP 384:ghxuq36riGxgbzL783C0hdxNcmIyiAcp/uIikOxEPGEIdOm9tb5YVQJv0mriWHLZ:dW6rlgbrUtooI9EEP9Iwm97YVQJv0iH1
TLSH
T1B0A29FF59D45B1B1F81AAC76A51886B3D710FCB4B92A00A3EFE514473C195FADB20D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140475681\steam_api.dll
Size 247KB
SHA256 9848b113a4cbbe430246bb87063cd3b9d65ae5f404a37adf9f9f03dfedc42fb7
MD5 442e3bd0b03314e819e0476e4e232a6f
SHA1 f8cb81fb6729dc7ab8b3f9ce06340508902b9265
SHA512 2e9eae049dc5987edc10bb669c9183a69817b29018c66116a59b00288760995a3820d08a5ea19952a001fbdc1f981d2bef56af3e28c480aceaaa8de9de140a14
SSDEEP 6144:eisYZCtnsm/LnKNtYMHGAIk9DRFjsylO2Cu2V6U:FsWCtnsm/Lit7mArQys2CZ6U
TLSH
T1CC44373538A149B1E5B581358AB8DE2F3AEC216B37342CFF634806B5C8635C35A3759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tracker_spec.pdb

Path C:\Users\Admin\AppData\Local\Temp\1791140475681\tracker_spec.pdb
Size 5.0MB
SHA256 0ddd4ad7b286d9a355c0cc7cd23cdece201e86cddd662b1e3fe7633b5202d0f9
MD5 d54e12892efffbe393910bd783728d60
SHA1 010851ac60da08c74ff1ec385aea908beb242045
SHA512 9d24d03fd4d9ba84316bdac4cba98493f72cc3dde6c16d51ad4d1273c23d1ab8b9223fc859a2ce9e5cf1371670accd395f61e0800f5796261f9484674acb301f
SSDEEP 98304:n2mlo7tPINolO4LRkit8cj2ah1Bzx2d/6vUV3R9WyMPvOxH/:do7tP+olMpciSBI6vUV3RcTv0
TLSH
T1E036231471E2593BE827AF01805B931AB2953DA8B215E3B260D775FF37395E8460EFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\1791140475681\ucrtbase.dll
Size 1.1MB
SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 c4a25dce665733663284750666684703
SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
TLSH
T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gP5e.7z

Path C:\Users\Admin\AppData\Local\Temp\gP5e.7z
Size 19KB
SHA256 8f806b8777275fa970abc84dd31820f1359332ddf40629315bcbeab8d9bfa737
MD5 ac24ea34e29c189a59489e55f972eba3
SHA1 bf40b3440ab7ec71007e48d329a216fbd541f922
SHA512 7b199b8ed46d8b791f308b866d0757ef68369313d251153a753aa41d3db6d1f563a3fcb1bdb78778dde0d3010d37a12477360721c5efd6c24322f37ef39821cd
SSDEEP 384:b1Pd1sMxLu0o+fwiiDIJTnLhcx8zzmk1zTaLWPHb69t2XLkJ7v23ty0/:xPdq0xR4ikulcSzzmk1XaLWskXLFwU
TLSH
T10892F1144EB1E21AC07C3FACB16B562E98F2AD4144CC4C967CEFB53E4261313B35DA62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5392_1845887913\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

daemon.log

Path C:\Users\Admin\AppData\Roaming\daemon.log
Size 8B
SHA256 9b73e281934d07f6b1678e4b91ce2712bd2a4e5e2b24f9bf32b2768a61ed9205
MD5 713ae8e98ad930c3264154ae369301e1
SHA1 d1aa20d2981fae59ac94646671a05c2d66fefa59
SHA512 6d11c18b36796ab0e436e7216da686184757780440a1e14d7ec2e54f9f2344328f11d9ed5e4c355005d66ae99f945c178b8b5a9ad6a2798b2683afecf6a146ef
MD5 SHA1 SHA512

Submit Download

memory/4196-3-0x00007FFD708F0000-0x00007FFD708F1000-memory.dmp

Download

memory/4884-27-0x00000000753E0000-0x00000000754D5000-memory.dmp

Download

memory/4884-28-0x00007FFD72020000-0x00007FFD72283000-memory.dmp

Download

memory/5964-35-0x00000000753E0000-0x00000000754D5000-memory.dmp

Download

memory/5964-38-0x00000000753E0000-0x00000000754D5000-memory.dmp

Download

memory/5964-42-0x00000000742E0000-0x0000000074BFC000-memory.dmp

Download

memory/5964-64-0x00000000742E0000-0x0000000074BFC000-memory.dmp

Download

memory/5964-40-0x00000000753E0000-0x00000000754D5000-memory.dmp

Download

memory/5964-36-0x00007FFD72020000-0x00007FFD72283000-memory.dmp

Download

memory/5964-46-0x00000000742E0000-0x0000000074BFC000-memory.dmp

Download

memory/5964-47-0x00000000742E0000-0x0000000074BFC000-memory.dmp

Download