hijackloader | 04b9cce52af1b7ff4f52a2ccf69deb161fef821acc61aa12c3866f2885263297

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/10/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Grape.exe
Size 99.7MB
Sample261005-wbe3taad63
SHA256 04b9cce52af1b7ff4f52a2ccf69deb161fef821acc61aa12c3866f2885263297
MD5 4c56b85558e7aba7dfdf492564837779
SHA1 1961dbf19dda3d825cfc4899ea0f0efcd31fdb80
SHA512 4e3f91922f2d12c2bf9c78ffc9572aa3a3202e40c27b637a448143425d03ac9a202bd0b3260826cbc6dce85c7e9b9381bdacb8c57d711af5d61c766b900cce6c
SSDEEP 786432:UqsjvUsvRjAfHvoj7/B10GczN5xwcJXTpWgYVvPM96Rc:t2vU0RjyPoj7p10GuN5xrXTpW8L
TLSH
T1F9387C03E3A610ECC09DC2759B1A9526EEB2BC450735B6DF266467212F76FE06B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution hijackloader loader persistence spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\KuxionPort
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4f2-26.dat	family_hijackloader

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Grape.exe"	Grape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Grape.exe"	Grape.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\E:\	DriveCircuitry.exe
\??\F:\	DriveCircuitry.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4156 set thread context of 4364	4156	DriveCircuitry.exe	103
PID 4156 set thread context of 6524	4156	DriveCircuitry.exe	132
PID 4156 set thread context of 4364	4156	DriveCircuitry.exe	103
PID 4156 set thread context of 6176	4156	DriveCircuitry.exe	139

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	DriveCircuitry.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	DriveCircuitry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DrosuraCloudlet.job	DriveCircuitry.exe

Executes dropped EXE 2 IoCs

pid	Process
5820	DriveCircuitry.exe
4156	DriveCircuitry.exe

Loads dropped DLL 6 IoCs

pid	Process
5820	DriveCircuitry.exe
5820	DriveCircuitry.exe
5820	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1732	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DriveCircuitry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DriveCircuitry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Grape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Grape.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriveCircuitry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriveCircuitry.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1940	chrome.exe
7120	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4156	DriveCircuitry.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4400	Grape.exe
4400	Grape.exe
1976	Grape.exe
1976	Grape.exe
5820	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4364	chrome.exe
4364	chrome.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4156	DriveCircuitry.exe
4364	chrome.exe
4364	chrome.exe
4840	Grape.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4156	DriveCircuitry.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeDebugPrivilege	4156	DriveCircuitry.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 5672	4236	Grape.exe	89
PID 4236 wrote to memory of 5672	4236	Grape.exe	89
PID 4236 wrote to memory of 4400	4236	Grape.exe	90
PID 2416 wrote to memory of 256	2416	Grape.exe	94
PID 2416 wrote to memory of 256	2416	Grape.exe	94
PID 2416 wrote to memory of 1976	2416	Grape.exe	95
PID 4236 wrote to memory of 1732	4236	Grape.exe	97
PID 1732 wrote to memory of 5820	1732	cmd.exe	99
PID 5820 wrote to memory of 4156	5820	DriveCircuitry.exe	100
PID 4364 wrote to memory of 5868	4364	chrome.exe	104
PID 4364 wrote to memory of 1940	4364	chrome.exe	105
PID 4364 wrote to memory of 2272	4364	chrome.exe	106
PID 4364 wrote to memory of 2272	4364	chrome.exe	106
PID 4364 wrote to memory of 2684	4364	chrome.exe	108
PID 4364 wrote to memory of 2684	4364	chrome.exe	108
PID 4364 wrote to memory of 2604	4364	chrome.exe	109
PID 4364 wrote to memory of 2604	4364	chrome.exe	109
PID 4364 wrote to memory of 3096	4364	chrome.exe	110
PID 4364 wrote to memory of 3096	4364	chrome.exe	110
PID 4364 wrote to memory of 1484	4364	chrome.exe	111
PID 4364 wrote to memory of 1484	4364	chrome.exe	111
PID 4364 wrote to memory of 2200	4364	chrome.exe	112
PID 4364 wrote to memory of 2200	4364	chrome.exe	112
PID 4156 wrote to memory of 4364	4156	DriveCircuitry.exe	103
PID 4156 wrote to memory of 4364	4156	DriveCircuitry.exe	103
PID 4156 wrote to memory of 4364	4156	DriveCircuitry.exe	103
PID 4156 wrote to memory of 4364	4156	DriveCircuitry.exe	103
PID 4156 wrote to memory of 4364	4156	DriveCircuitry.exe	103
PID 4364 wrote to memory of 3084	4364	chrome.exe	113
PID 4364 wrote to memory of 6108	4364	chrome.exe	115
PID 4364 wrote to memory of 6108	4364	chrome.exe	115
PID 4364 wrote to memory of 3720	4364	chrome.exe	116
PID 4364 wrote to memory of 3720	4364	chrome.exe	116
PID 4364 wrote to memory of 2184	4364	chrome.exe	121
PID 4364 wrote to memory of 3568	4364	chrome.exe	122
PID 4364 wrote to memory of 3716	4364	chrome.exe	123
PID 4364 wrote to memory of 2184	4364	chrome.exe	121
PID 4364 wrote to memory of 3568	4364	chrome.exe	122
PID 4364 wrote to memory of 3716	4364	chrome.exe	123
PID 4364 wrote to memory of 3568	4364	chrome.exe	124
PID 4364 wrote to memory of 1496	4364	chrome.exe	125
PID 4364 wrote to memory of 4868	4364	chrome.exe	126
PID 4364 wrote to memory of 3568	4364	chrome.exe	124
PID 4364 wrote to memory of 1496	4364	chrome.exe	125
PID 4364 wrote to memory of 4868	4364	chrome.exe	126
PID 4364 wrote to memory of 2092	4364	chrome.exe	127
PID 4364 wrote to memory of 1152	4364	chrome.exe	128
PID 4364 wrote to memory of 2092	4364	chrome.exe	127
PID 4364 wrote to memory of 6128	4364	chrome.exe	129
PID 4364 wrote to memory of 1152	4364	chrome.exe	128
PID 4364 wrote to memory of 6128	4364	chrome.exe	129
PID 4364 wrote to memory of 5112	4364	chrome.exe	130
PID 4364 wrote to memory of 5112	4364	chrome.exe	130
PID 4364 wrote to memory of 1948	4364	chrome.exe	131
PID 4364 wrote to memory of 1948	4364	chrome.exe	131
PID 4156 wrote to memory of 6524	4156	DriveCircuitry.exe	132
PID 4156 wrote to memory of 6524	4156	DriveCircuitry.exe	132
PID 4156 wrote to memory of 6524	4156	DriveCircuitry.exe	132
PID 4156 wrote to memory of 6524	4156	DriveCircuitry.exe	132
PID 4156 wrote to memory of 6524	4156	DriveCircuitry.exe	132
PID 4156 wrote to memory of 6524	4156	DriveCircuitry.exe	132
PID 4156 wrote to memory of 4364	4156	DriveCircuitry.exe	103
PID 4156 wrote to memory of 4364	4156	DriveCircuitry.exe	103
PID 4156 wrote to memory of 4364	4156	DriveCircuitry.exe	103

C:\Users\Admin\AppData\Local\Temp\Grape.exe
"C:\Users\Admin\AppData\Local\Temp\Grape.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1756,13753530937446094631,14622245952727704606,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1764 --ignored=" --type=renderer " /prefetch:2
  2⤵
  PID:5672
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=utility --field-trial-handle=1756,13753530937446094631,14622245952727704606,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2144 /prefetch:8
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\1791222445238\DriveCircuitry.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\1791222445238\DriveCircuitry.exe
    "C:\Users\Admin\AppData\Local\Temp\1791222445238\DriveCircuitry.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\ProgramData\KuxionPort\DriveCircuitry.exe
      C:\ProgramData\KuxionPort\DriveCircuitry.exe
      4⤵
      Enumerates connected drives
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Drops file in Windows directory
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4156
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:6524
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:6176
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1756,13753530937446094631,14622245952727704606,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840

C:\Users\Admin\AppData\Local\Temp\Grape.exe
C:\Users\Admin\AppData\Local\Temp\Grape.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1828,12774577248878493012,13204559857575885080,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1824 --ignored=" --type=renderer " /prefetch:2
  2⤵
  PID:256
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=utility --field-trial-handle=1828,12774577248878493012,13204559857575885080,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2212 /prefetch:8
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Users\Admin\AppData\Local\Temp\Grape.exe
  "C:\Users\Admin\AppData\Local\Temp\Grape.exe" --type=gpu-process --field-trial-handle=1828,12774577248878493012,13204559857575885080,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  PID:1624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:2432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff6333c728,0x7fff6333c734,0x7fff6333c740
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,11200563418034180113,11645108418957913129,524288 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,11992599425878220758,5012597971523738773,262144 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,841955126893459572,16846070414171690095,524288 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:13
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,11151190818827174310,3941743369470752928,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,18314551322620456733,331467462802573952,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,17357856737082803908,5704754445852910252,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,11157530967633224608,18178308554501108118,524288 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,15051611121498507228,7448390319301106102,524288 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5472,i,13333310579456716463,1946709500406521957,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5536,i,8542015914669443388,8911808933499319408,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5828,i,10854884796965678393,10078586729738510857,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,11815498142790310383,16672424339359064690,524288 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5824,i,5913710208486908758,16390414202006424114,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,10222500211039813881,16908643314402177508,524288 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5452,i,6555908449739886937,6963652357754470114,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6400,i,11049779898666113513,16105450135998745690,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6364,i,1721161163709955064,14753675105380703743,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,15828145337105442462,4674559281449761657,524288 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6584,i,1428994544574669597,16828053084397777064,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5764,i,8420658717653488711,15199593236027129311,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6352,i,5517127748780757812,1526965693117155766,2097152 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,11833346166017130686,17919389266187905743,524288 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,18100209998815296217,3897368704553660353,524288 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,10671902529943288690,10124385340510557348,524288 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,6280187951754837672,8801823898439489721,524288 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:11
  2⤵
  - System Time Discovery
  PID:7120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5756,i,9732983783642423270,6680634014308409159,262144 --field-trial-handle=2036,i,7415789737194212078,18333762511297011128,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:10
  2⤵
  PID:6248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2200

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a74e080d84c7a3b5c1352d88d9035b6cfa97170e

Path C:\ProgramData\Gebilaxu\Heleru\a74e080d84c7a3b5c1352d88d9035b6cfa97170e
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

18a9fd5b-e143-4bc0-a120-3f6aa2d2e657.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\18a9fd5b-e143-4bc0-a120-3f6aa2d2e657.tmp
Size 138KB
SHA256 bc2657459bfb4c73bac8101b14d96fdd9ebac7f71f75e8cabd2cf869172b1da8
MD5 c8b141cd7bf071af4e2a7d31dc9aa8a2
SHA1 9d3215cf0fb241cd1fc7330249cd05bcbc94dff1
SHA512 daacb2d8afffc1a9a487d717f4949f71cddc0e32c64f25d492f2d05cbfc296903d39bec47a70b0a1ab154676daae7666f0785227d8de00d18f26226cdb8bd141
SSDEEP 3072:UmsIftPQzg6iLYfVhiePz53rN76h7et2G61YvbBnvAU2h5:Umbd6SYRzlNA7wZ6CTBnvAl/
TLSH
T11CD31271EA8ECDE74916F99A716F2CEFDDB0A6E3489C0E7807E003455D6FA981F09520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

677c590c-6834-4525-8a28-74142cf06fbf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\677c590c-6834-4525-8a28-74142cf06fbf.tmp
Size 139KB
SHA256 fafe9b1bbac1b59eeceaa64d0e9c6d2c7729592450d60e51a885edb6dd36340a
MD5 3001e3f92827ed877137926d44341a8b
SHA1 1fb790002e8bb0b0b115d1904b9f1973606c96d4
SHA512 0c9ed6aeb353a2768363a81a21407a7edb20b738d1a652a60ffd9aea289bd8b5b26128f071b978b76f5740418445d69acea80c2d2af8b8d779fd1aaeacabdbb8
SSDEEP 3072:RmsIftPQzg6iLYfVhiePz53rN76h7et2G61YvbBnvAU2h5:Rmbd6SYRzlNA7wZ6CTBnvAl/
TLSH
T1CFD31272EE4E8DE70922E9D9616F2CEBDCB0A5E74C5C1E3C0BE013455D6F6981F0A960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

157376dd-ebc5-4778-8072-64eaefda33fb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\157376dd-ebc5-4778-8072-64eaefda33fb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

41de8206-cb8c-4f65-90a8-5ab61ccba60b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\41de8206-cb8c-4f65-90a8-5ab61ccba60b.tmp
Size 10KB
SHA256 00921b01bc0e4b768ea09e4376147c90516b4f0f1b611adf080fb1703a00bf60
MD5 22c40e891baee5b5125f10949b4100c9
SHA1 930b4e98c193abbf2a07b6b6323b705e9944c21d
SHA512 f0771c67469effb55c0ab7e713bec303d557a395e04d20242e3f9a887b3d5f3b50df369db6727a80fc9d37de967e43acb0ddb91df96a9544b5ce05b4b5271994
SSDEEP 192:8ReKTL53v7AUAPRp2b9BHsb+WNnzg0Sl2MeK2VyIsnAUgR:8ReKf5fMXUDws062VR
TLSH
T19B32A42AEE14797B5CDBD21AFA767757E3F5002225902E88EAFC893C24E75CC2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91bd760a-278e-4aa0-bf46-195501248350.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\91bd760a-278e-4aa0-bf46-195501248350.tmp
Size 11KB
SHA256 78aed625110e9287e43ce7ef6999dfd15e34dd5f99a586c878e465e2827e352d
MD5 bb2579c72af4015640e92184e67b4215
SHA1 3544ab3210d7f809f1ddca721b301848ad4954af
SHA512 fedbdab51299582168f7f4e9953820a1594ab9a8fa8c54f38333474352300debabe754d50ea37b5d86e9d38289edfa0fabc24331e20f68ba97cbb4892fa83219
SSDEEP 192:8ReKTL53v7AUPPRpNb9BHsb+WNnzg0wl2MeKaVyIsnAUgE:8ReKf5fxXVDws0427E
TLSH
T1C342B72EEE14797B5CDBD21AFA667B57E3F4102221902E88E6FC893C25E75CC2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 83d1d6e1a2b174345599372eea0906aa93aa8d939db22c232ce29336bb720410
MD5 2f8a327742b753fc4d5263984b2f81e2
SHA1 4a5b85eec01a09ccb4951a2d7a3b11773d2ba8b3
SHA512 6bdc638c239fc5c43455d96cc837ff5db1487bd4b5680ddc4cd2a6e6e29882e0e6db79c13edb5fd2baec18017a430f61ae8c7a3f9406e8fcfa4100f7db1c1f60
TLSH
T13DE022A9C922EC3719FE075960840B46E64213673B419A0F3A3CD6098FF0A6B16C689C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 44KB
SHA256 0fe93041745de2073c3da8a2228178bd382357b9e589220930215a15438d7232
MD5 c968a9113ba84e6fad02ba7108f8b511
SHA1 8c0b5b0ffe3a9f7a2e288f7b9e38c9de1e88ae1c
SHA512 cfa04d652c2d612c7f4733111b858a55dc2187c2c05e79d5417f6ae9cd69cc6eeccb0d09f86f5b1e958e5c7aa8d47a2831734b68e47a9e877f2f2995e68ab58a
SSDEEP 48:N4JqQq3qhmr/O43b/Y8uaLNW9WjWbfl4pwU+/xwkA/0+n:UCEmrm43b/LuaLNW9WjWbflh/xs0+n
TLSH
T1B51312068F257CF1E08A8B3689C186E61EFD0758F35B1E6C75A814D19D91544CCBB1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG
Size 317B
SHA256 104c674a9151c407a34f1050624696aa498fcfc03503d9b9c7e7ae4506bd8eb3
MD5 76a7c1e45b642d67b0be1bc5e863118d
SHA1 17968e794c0464cac833d3e9d3b6e5ad057dd1a5
SHA512 c343d2d4c2e054490371c90dea97077cbf010b6baac54e0a1c04e8460bd0c0b2f633f9cbbc585acb391e9d0a48e7a301dd37c421f393b20608207ee3fc45c8e9
TLSH
T116E026992588CE2D201CC4D7C3A1A72DCFE83408EBD53446974FC881248D808A2C0264
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log
Size 95B
SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
MD5 021b8d293c14358bb37b18ba45792aa5
SHA1 22e73b3a1d152734191bf7de9472a54be346b706
SHA512 ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG
Size 324B
SHA256 4119485993370a55919f0cdf5e221bf75f2cc6dd7c479c4103653f302031e1aa
MD5 51072e0f773ca421fecab9c28b45a4b2
SHA1 8c10deaf9f1d074fa3a834b1913f2056e339e82b
SHA512 e3593490d0858ee50eca5cb400595cac69f1ccb895332f39e5f5fed1fa1ee1d9960f5203c3934a3f815f4c712e66c7d775a01a4c62e5aef7b05e39d8590cccac
TLSH
T105E086DC3889CDBD245E98D34372FB2DCBD83504AAC57C56574BCDA1258D904A290665
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 f984ade9b598f666c12bd3e6a78250747d45c0c4f33510076d2ce4fd3c968e46
MD5 398ce10c709d8370aaf407a1760fe182
SHA1 d020bbb6a2f1f1650f78b375d964af50c68e7119
SHA512 6ed2164148ca89d68029550943700a3010acce6d26b1a0495306d0da14e394bc689e4a5f704d36128b74678d6fe6b74ff34577b71d82b6151c62b35e08ee5270
TLSH
T13CE07D9425CCCD2D665CE8EB0764732DCFD43642FAD4B946074DCC44258ED0663E1374
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 1KB
SHA256 d7f4cd748dac09ce753ba3cd7f928d4d5b2865762af545dcdf06c53c951a6d1e
MD5 baef2f4cbd7b1f1603e4aaefdfe88b5e
SHA1 c21d601e91e92f41b0f2e66b99b6e251cb2bbb09
SHA512 2b85d26d798baaa23c579f493b88a86d62f7944f9b987e21152e762eb58a9436164462d8311e457d105634a9ed95c6f818f1f8aa735db5ef65565e03a07a17ef
TLSH
T1182130EC2F9277A3DB3A0CBAAE4523023EB180E0029120D743D888663DC5E602A132C6
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 265B
SHA256 1812e23b40c64273703a919c7c6b098810203463281c47bf97ca5f82aa02e470
MD5 9920d09bdedfb87915450d7086fc8140
SHA1 12eb1bfa6e284c16d992131bfd34ad0861afcb79
SHA512 486938c1420652aff182d1b8924dc899539ed4e8e1f5fbdea6cc82a584f5c84851a3dbd5f05dcd2fefa748caac51d7d74f243bdb6e7fd0625781a2c5fb2beee0
TLSH
T1E3D02B4629D0CF6F0154C8F30620A32ECFCC3444DBE9250A8F18EC0414CE80CA2E12AA
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

4a3e87bd-01fb-4df1-812c-32a36ac983b9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4a3e87bd-01fb-4df1-812c-32a36ac983b9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a47ed98b-c3b5-45eb-b7f7-1bdc7b3ba3dd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a47ed98b-c3b5-45eb-b7f7-1bdc7b3ba3dd.tmp
Size 2KB
SHA256 e72fbadb14af7f639cbcd650962f3fa8c6fede714ade37deed543875db185cfd
MD5 f1845e2e0a8799bcf456dc509958d8a5
SHA1 0c567256b138441d8236072d108d20208027dde4
SHA512 3fee69a2736a92a026d26430b7f12fd76e2048191ba221eb7aa1c1b993cb1629309b810e5a352f279f85446dca87dcca3e4a30602055d9345ba79f43d4e65293
TLSH
T1D6518CF3D3D89A6DC81566E4DB216E1FCD2D0A28521C3C66C8D8AF5B53E2872D35138E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 f150fd52238da677dc64c412fcc628c634527a99d1a3bbf17e3d143c4df81063
MD5 90be2fd7adfa6ae4b33416f6cd1522f5
SHA1 929eff408bb9f02964cb4752153a507315980c3b
SHA512 e64d995daac2dcb78c2dbb027e6a5d183df7f1da23ba68a75fe440abec24af61eef6f74006512229e73ebfb82b7f26833374ac53511034b0e6888cd18adb7f66
TLSH
T1C2A0021152E49CA5CD144670F2A70D41269A6D582992471358960844FCEB1D1C501208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d12a3a1cebba6d8457ebe9661dc79fef07cd62d4e64072086125853a21b3e3e8
MD5 41c4464ce7d540a7da326bcded405801
SHA1 1523bee061242b7746eb92f959e4193768843818
SHA512 9cfd5aa326891145f651267fde16d67a1ee2f806afe8f09469adbc44bfb7cd71ef993aacacb83f3983a6bfa6753086cc4e5b57b53bfd80978dccafc763ecc690
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

de926aa3-c460-44b5-8f8f-3bcd010acaf5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\de926aa3-c460-44b5-8f8f-3bcd010acaf5.tmp
Size 11KB
SHA256 41dfb0ac37e1768ed52dfea5ad8fd837eeb45b9ce92e4ab33e24247f94abfccd
MD5 024533dfd84caddfe440ab7353492371
SHA1 8c911cdb27f7da8722aede44ed3e3f0f29f51ab0
SHA512 38a873588ec1c20c0587103467f4ba3e812472a99d066f1d3b9193fa867c412fb2e9a76f8cc61a85e81bca0cee8a7d5ff6775a7c666a195110843d88c7b3a007
SSDEEP 192:e+R4K6v77KxkXqK4I40pUZNCgVLHrKHfFKslEUWgXzKD/Y3+ErUkKN9aZVaC66/m:XRjg77KxkXqKf/pUZNCgVLH2HfgslwgS
TLSH
T11432D827A48D9A7F0FD8D509CC576F8FADB4029272784D2456FB9C0803A578E124B6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heavy_ad_intervention_opt_out.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db
Size 16KB
SHA256 3f988de8cc924d73c7490c68529a8b25a9ca22f9578c594f554d1e06e0fac307
MD5 d3c18b5df876d89397c233263de4d4ee
SHA1 8ddc51297582d13332d57893a998f114ee504115
SHA512 9e4a3fd3819b6e9f1708f979fc9495fd1bdabc0e8d057767c4febc8fa855cc6e2e8d45c994e5c327ba87855a741034e2d71bacae23b2bc68cd0974eb1e7dafa0
SSDEEP 12:TLCewaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLvdBgtBgJBgQjiZS53uQFE27MCgGZsR
TLSH
T1FF72596D4D14B201C4BF9E75ACC1C0D23A2C712B0757B6E1A74023FF48AE032A5358A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 7fae429815b70613bbea6e6273594ac1906876721f4825a7c26a853ccdf1e24b
MD5 25f15ae8a8ceabce2e270d8e665472cc
SHA1 8d0a5f6234545e28d5cdc3aa9b6259f98f61465b
SHA512 45031ea79aa29c0de8e946f3b4081cd5f789d52f4e8a83a6520a58510b0a9877a88ca88dbff0a0fc80f5fc411e55e188ecbc481efbfe7793963f7c2d9532aa27
SSDEEP 3072:xmsIftPQzg6iLYfVhiePz53rN76h7et2G61YvbBnvAU2h5:xmbd6SYRzlNA7wZ6CTBnvAl/
TLSH
T177D31272EA8ECDE74916F99A716F2CEFDDB066E3489C0E7807E003455D6FA981F09520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

a73fb14c-c6ab-4198-8190-8195aecc97ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a73fb14c-c6ab-4198-8190-8195aecc97ba.tmp
Size 4KB
SHA256 4fc9c8388bb9acb0a74b0fd209a704f3e6d81d9d80eef311894cd45a026776ac
MD5 dc07e168d5c3fdaf6b44af3599000426
SHA1 c9b17d898c8c556078a546a43017ff380aaf6d3c
SHA512 8f2fcab4afbfdb17905181c03c2f3ca9a42a4ff71c7adce413fcbf3da1e1c90dc07c0d3660257e9ae173d3bb68fa2701b0a2ac6416d04d69b8655760d2553b7b
SSDEEP 96:uFC0d+qs7PiY+3oDfAI0jMrRDotok5KgNDTB6ndGyvze9abjbfEv4a:uFC0t+W1I04DUD7N4wL9abjbu
TLSH
T1BAA12A71E52E5CBB54B6D945B1533A43CF79A26BA8215F84D9ED6B0C04F70EC0382123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2c48287-dc52-4970-bc5c-afcef678efb2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e2c48287-dc52-4970-bc5c-afcef678efb2.tmp
Size 138KB
SHA256 448dc089a06a553e542a538ace69866d94249b0150a2dd0b36f543490f66f5db
MD5 4574a4059dbe13e039c3127611d2696e
SHA1 c0fdf40ed301cb163fd6659a303f4ec6d836e2f1
SHA512 697ab38f542d149b326ea0ea0306dd4a6033a30057efbd794cc2dc68f8a27b10019fdc95d9a6591ab418d80d0e920fc19468c258962e433eb4c0de40d3c9c65c
SSDEEP 3072:FmsIftPQzg6iLYfVhiePz53rN76h7et2G61YvbBnvAU2h5:Fmbd6SYRzlNA7wZ6CTBnvAl/
TLSH
T192D31272EA8ECDE74916F99A716F2CEFDDB066E3489C0E7807E003455D6FA981F09520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriveCircuitry.exe

Path C:\Users\Admin\AppData\Local\Temp\1791222445238\DriveCircuitry.exe
Size 1.7MB
SHA256 399d07658c7d30dffb42b1e4b83904f5334a93cfb71f2516d5161d4cb4930c16
MD5 05b04eebdcedce5555b1e2d225c54c3b
SHA1 90d21f29df7f288d5711503cc00c4b6dae9db8d8
SHA512 971cf26a26b32e3d250255e50bc754cae545894b7e479378399a211c94bdf9d2cdfc23965a1875f1a5a201f01cc2b3c7c056f7103c9b76b0423ad8b25d1bca44
SSDEEP 24576:uip+eMB5CzFwhStFNEWwerW16DWpt8gd5rjNPyeDh0lhSMXlumm8KytGn:xMB2FAStFqff/8gL5yW8K+Gn
TLSH
T1CF858D317105C036E69212F1986EAFAE969C9E340BF658D7A3C43F6E59301C37B35A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

covrun32.dll

Path C:\Users\Admin\AppData\Local\Temp\1791222445238\covrun32.dll
Size 1.2MB
SHA256 b52469ae233c5e8333e9e4d0304abafcdd3ca230fd0d4746148048a84a8a74c7
MD5 2c3247955a9517f1e31c6fe573c13007
SHA1 db5c2837788d312b39edeb497416df1c3e964a4a
SHA512 e32f44146ee304969c2c58c96e22491028610da21fb50ac6c0a5ad523d26912fafe4f03f109a6275cf447f73f082ad3129c1e0ec747ef055987ad325e69682a5
SSDEEP 24576:zvgVx+HPPKiqF9RXI/Nco6Y8XqyVHNotKhuR79jdt7Okaw9AYe3wzpBLnm2Wnj/6:jzHaiqF9R4FcYyqyVHNotKsvjdhOS9Am
TLSH
T1774529113295F025ED7D3E71183BEAAB5EFDBA613B7080FB53846A5B58206C1DE30E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord-rpc.x86.dll

Path C:\Users\Admin\AppData\Local\Temp\1791222445238\discord-rpc.x86.dll
Size 580KB
SHA256 93541ae3a14cfdb5bbc2f33abe9d742ae28a6e2873b20e0bc18b9ff71a5e8e5e
MD5 00172a5a5fb1798968d10759cd242dc9
SHA1 ad75f873dcb0ae0ede9aa21c9168f2c8a9b1a718
SHA512 b85fa26cb094e038335e29f15aef4505311a804755c6ec6d70f593831259e9f1028447b7d4324c0c721fce7d77d6f6b62594987169045d8f10a5a646a75581e8
SSDEEP 6144:RWzsNrb2/twRx2ax9L66vBvOz+f8uOU3g86oxaeZnyHuKfILz4ta+b:RuqHKtEkaxcuBvm+fnZcuKfIP+
TLSH
T1ABC46D51B4808271ECE621BA82ECB63642BDE4F007146ADB5BD80BFFE7605D1AF32557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\1791222445238\msvcp_win.dll
Size 493KB
SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 7762c51ea02eb943183d597ea0ee5530
SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
TLSH
T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registry-def.ini

Path C:\Users\Admin\AppData\Local\Temp\1791222445238\registry-def.ini
Size 22KB
SHA256 02baffa1b00f467ed73a995895f2fa3459fd1868fb1e13b9fbcfc6138d5e1ea3
MD5 99273bfc4bd985f5ba7311468675c127
SHA1 2e47c838913c28b4bd43e14f3b6b89798fc81a11
SHA512 c6c2f4498cd0effe0fc9394a7e3714f96fc6fd8e722d812c8add09cc2140ff4f7593ae718ce6a74ab7db6b938a4bae2b3af3efd8fc0224030b0cacf6722232cc
SSDEEP 384:ghxuq36riGxgbzL783C0hdxNcmIyiAcp/uIikOxEPGEIdOm9tb5YVQJv0mriWHLZ:dW6rlgbrUtooI9EEP9Iwm97YVQJv0iH1
TLSH
T1B0A29FF59D45B1B1F81AAC76A51886B3D710FCB4B92A00A3EFE514473C195FADB20D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api.dll

Path C:\Users\Admin\AppData\Local\Temp\1791222445238\steam_api.dll
Size 247KB
SHA256 9848b113a4cbbe430246bb87063cd3b9d65ae5f404a37adf9f9f03dfedc42fb7
MD5 442e3bd0b03314e819e0476e4e232a6f
SHA1 f8cb81fb6729dc7ab8b3f9ce06340508902b9265
SHA512 2e9eae049dc5987edc10bb669c9183a69817b29018c66116a59b00288760995a3820d08a5ea19952a001fbdc1f981d2bef56af3e28c480aceaaa8de9de140a14
SSDEEP 6144:eisYZCtnsm/LnKNtYMHGAIk9DRFjsylO2Cu2V6U:FsWCtnsm/Lit7mArQys2CZ6U
TLSH
T1CC44373538A149B1E5B581358AB8DE2F3AEC216B37342CFF634806B5C8635C35A3759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tracker_spec.pdb

Path C:\Users\Admin\AppData\Local\Temp\1791222445238\tracker_spec.pdb
Size 5.0MB
SHA256 0ddd4ad7b286d9a355c0cc7cd23cdece201e86cddd662b1e3fe7633b5202d0f9
MD5 d54e12892efffbe393910bd783728d60
SHA1 010851ac60da08c74ff1ec385aea908beb242045
SHA512 9d24d03fd4d9ba84316bdac4cba98493f72cc3dde6c16d51ad4d1273c23d1ab8b9223fc859a2ce9e5cf1371670accd395f61e0800f5796261f9484674acb301f
SSDEEP 98304:n2mlo7tPINolO4LRkit8cj2ah1Bzx2d/6vUV3R9WyMPvOxH/:do7tP+olMpciSBI6vUV3RcTv0
TLSH
T1E036231471E2593BE827AF01805B931AB2953DA8B215E3B260D775FF37395E8460EFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\1791222445238\ucrtbase.dll
Size 1.1MB
SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 c4a25dce665733663284750666684703
SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
TLSH
T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90f7e2a3-1ebd-4755-a77e-7664b099828f.tmp

Path C:\Users\Admin\AppData\Local\Temp\90f7e2a3-1ebd-4755-a77e-7664b099828f.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NYfaih.7z

Path C:\Users\Admin\AppData\Local\Temp\NYfaih.7z
Size 18KB
SHA256 1dc0e337fc1d652b3323188db1a980809f146da2840b4faa8307faa42b48817f
MD5 92dc7f4147d74017c16a15516895f9de
SHA1 7b14da11d33e116931dcec9819b2643e0b7b1579
SHA512 51bffebee5c7a321d2ffa22ea14256b6b96de8d08a0835972cf4cebd757bfdb8d56854874463e09d9df288718715f1c128270ab337b56b13bd17edfcd315ad38
SSDEEP 384:3Tm1AVgfkarO8P9siXQEUSDrcqMq0U6dZHkHAJr:39a8arO8FsR4oQ0vHnl
TLSH
T1AB92D112DB819AE7089995313EDAAC239564C119E609707A5E4FB2BF6C6DBDF340093C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4364_477318126\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

daemon.log

Path C:\Users\Admin\AppData\Roaming\daemon.log
Size 8B
SHA256 21cccb71b50c97b5dcb5999bed44046b5ab2ba7b2b7987bf416408a30ac15985
MD5 ee380d841625f37eb16f07e08116d003
SHA1 0f9806cc82b54e7c91d731a378577ce79ccefcd7
SHA512 626d401f4d66017a197af07db83d03541ff6a154bb6c22a1a043f29091a62e7e3df01f5c8477a364dca6abce7a8de11870640693baf402a8e2d19155b3ca3a56
MD5 SHA1 SHA512

Submit Download

memory/256-742-0x0000027D73490000-0x0000027D73880000-memory.dmp

Download

memory/256-50-0x0000027D73490000-0x0000027D73880000-memory.dmp

Download

memory/256-51-0x0000027D73890000-0x0000027D73938000-memory.dmp

Download

memory/4156-55-0x0000000073680000-0x0000000073F9C000-memory.dmp

Download

memory/4156-35-0x0000000074780000-0x0000000074875000-memory.dmp

Download

memory/4156-36-0x00007FFF8A7E0000-0x00007FFF8AA43000-memory.dmp

Download

memory/4156-38-0x0000000074780000-0x0000000074875000-memory.dmp

Download

memory/4156-40-0x0000000074780000-0x0000000074875000-memory.dmp

Download

memory/4156-41-0x0000000073680000-0x0000000073F9C000-memory.dmp

Download

memory/4156-47-0x0000000073680000-0x0000000073F9C000-memory.dmp

Download

memory/4156-46-0x0000000073680000-0x0000000073F9C000-memory.dmp

Download

memory/5672-86-0x0000022D4FB60000-0x0000022D4FF50000-memory.dmp

Download

memory/5672-49-0x0000022D4FF50000-0x0000022D4FFF8000-memory.dmp

Download

memory/5672-48-0x0000022D4FB60000-0x0000022D4FF50000-memory.dmp

Download

memory/5672-740-0x0000022D4FB60000-0x0000022D4FF50000-memory.dmp

Download

memory/5672-3-0x00007FFF89130000-0x00007FFF89131000-memory.dmp

Download

memory/5820-27-0x0000000074780000-0x0000000074875000-memory.dmp

Download

memory/5820-28-0x00007FFF8A7E0000-0x00007FFF8AA43000-memory.dmp

Download