5d501d3c51576a402a301470f7bf919b87e0f8a0ed40172dde3d7c1c622ccdc3

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 21:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CircuiTranspon.exe
Size 108KB
Sample261007-1rsfascf72
SHA256 5d501d3c51576a402a301470f7bf919b87e0f8a0ed40172dde3d7c1c622ccdc3
MD5 a3d2a2cdfe0f51e0194de4e66f5a4e59
SHA1 9e74abf1cb6ce8d4d8fd1a564fac9dfa3df806bc
SHA512 5cdb2276cc69fff03ae7ee7566f46e3fc0603d0f7e0337f39f089ebdfa4563cfa6cdb8c83c3839c5767212578cc195f87d19a903ed50e26c7ca6643db5489005
SSDEEP 1536:5x38QUYa1eDrFhKweJ13+V7XIw9mBiL5axtuA4Bd6JVoJGLn05UuiFCMR10NTkGr:PDijCUfjyMr17C0IEnOnDLCg/taX21
TLSH
T1DDB33A21B7449827E972D1776AF8FF294A2CE0B0479110DF72682DCDA9709D31D3A1EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery privilege_escalation spyware stealer

Malware Config

Signatures

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 976 set thread context of 4800	976	CircuiTranspon.exe	90
PID 976 set thread context of 4740	976	CircuiTranspon.exe	92
PID 4800 set thread context of 1728	4800	VortexForg128.exe	95
PID 4800 set thread context of 4568	4800	VortexForg128.exe	126
PID 5604 set thread context of 5340	5604	CircuiTranspon.exe	125
PID 4800 set thread context of 1728	4800	VortexForg128.exe	95
PID 5604 set thread context of 2764	5604	CircuiTranspon.exe	129
PID 4800 set thread context of 4268	4800	VortexForg128.exe	134

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	VortexForg128.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	VortexForg128.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	VortexForg128.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	VortexForg128.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	VortexForg128.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	VortexForg128.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	VortexForg128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	VortexForg128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	VortexForg128.exe

Executes dropped EXE 2 IoCs

pid	Process
976	CircuiTranspon.exe
5604	CircuiTranspon.exe

Loads dropped DLL 33 IoCs

pid	Process
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
4800	VortexForg128.exe
4740	memu.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5340	VortexForg128.exe
2764	memu.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	VortexForg128.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	VortexForg128.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	VortexForg128.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	VortexForg128.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VortexForg128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CircuiTranspon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VortexForg128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CircuiTranspon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CircuiTranspon.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3580	chrome.exe
3108	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4800	VortexForg128.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5968	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
976	CircuiTranspon.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4740	memu.exe
4740	memu.exe
4740	memu.exe
4740	memu.exe
4740	memu.exe
4740	memu.exe
4740	memu.exe
4740	memu.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
1728	chrome.exe
1728	chrome.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe
4800	VortexForg128.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4800	VortexForg128.exe

Suspicious behavior: MapViewOfSection 1 TTPs 4 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
976	CircuiTranspon.exe
976	CircuiTranspon.exe
5604	CircuiTranspon.exe
5604	CircuiTranspon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeDebugPrivilege	4800	VortexForg128.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5968 wrote to memory of 976	5968	CircuiTranspon.exe	89
PID 976 wrote to memory of 4800	976	CircuiTranspon.exe	90
PID 976 wrote to memory of 4800	976	CircuiTranspon.exe	90
PID 976 wrote to memory of 4740	976	CircuiTranspon.exe	92
PID 976 wrote to memory of 4740	976	CircuiTranspon.exe	92
PID 1728 wrote to memory of 4648	1728	chrome.exe	96
PID 1728 wrote to memory of 3580	1728	chrome.exe	99
PID 1728 wrote to memory of 4348	1728	chrome.exe	101
PID 1728 wrote to memory of 4348	1728	chrome.exe	101
PID 1728 wrote to memory of 2872	1728	chrome.exe	102
PID 1728 wrote to memory of 2872	1728	chrome.exe	102
PID 1728 wrote to memory of 4064	1728	chrome.exe	103
PID 1728 wrote to memory of 4064	1728	chrome.exe	103
PID 1728 wrote to memory of 5800	1728	chrome.exe	104
PID 1728 wrote to memory of 5800	1728	chrome.exe	104
PID 1728 wrote to memory of 5252	1728	chrome.exe	105
PID 1728 wrote to memory of 5252	1728	chrome.exe	105
PID 1728 wrote to memory of 4616	1728	chrome.exe	106
PID 1728 wrote to memory of 4616	1728	chrome.exe	106
PID 4800 wrote to memory of 1728	4800	VortexForg128.exe	95
PID 4800 wrote to memory of 1728	4800	VortexForg128.exe	95
PID 4800 wrote to memory of 1728	4800	VortexForg128.exe	95
PID 4800 wrote to memory of 1728	4800	VortexForg128.exe	95
PID 4800 wrote to memory of 1728	4800	VortexForg128.exe	95
PID 1728 wrote to memory of 2824	1728	chrome.exe	108
PID 1728 wrote to memory of 4080	1728	chrome.exe	110
PID 1728 wrote to memory of 4080	1728	chrome.exe	110
PID 1728 wrote to memory of 3664	1728	chrome.exe	111
PID 1728 wrote to memory of 3664	1728	chrome.exe	111
PID 1728 wrote to memory of 1472	1728	chrome.exe	112
PID 1728 wrote to memory of 1472	1728	chrome.exe	112
PID 1728 wrote to memory of 912	1728	chrome.exe	113
PID 1728 wrote to memory of 912	1728	chrome.exe	113
PID 1728 wrote to memory of 2484	1728	chrome.exe	114
PID 1728 wrote to memory of 2484	1728	chrome.exe	114
PID 1728 wrote to memory of 4816	1728	chrome.exe	115
PID 1728 wrote to memory of 4816	1728	chrome.exe	115
PID 1728 wrote to memory of 2876	1728	chrome.exe	116
PID 1728 wrote to memory of 2876	1728	chrome.exe	116
PID 1728 wrote to memory of 1324	1728	chrome.exe	117
PID 1728 wrote to memory of 1324	1728	chrome.exe	117
PID 1728 wrote to memory of 3824	1728	chrome.exe	118
PID 1728 wrote to memory of 3824	1728	chrome.exe	118
PID 1728 wrote to memory of 4088	1728	chrome.exe	121
PID 1728 wrote to memory of 4088	1728	chrome.exe	121
PID 1728 wrote to memory of 4252	1728	chrome.exe	122
PID 1728 wrote to memory of 4252	1728	chrome.exe	122
PID 1728 wrote to memory of 2464	1728	chrome.exe	123
PID 1728 wrote to memory of 2464	1728	chrome.exe	123
PID 1728 wrote to memory of 4680	1728	chrome.exe	124
PID 1728 wrote to memory of 4680	1728	chrome.exe	124
PID 5604 wrote to memory of 5340	5604	CircuiTranspon.exe	125
PID 4800 wrote to memory of 4568	4800	VortexForg128.exe	126
PID 4800 wrote to memory of 4568	4800	VortexForg128.exe	126
PID 4800 wrote to memory of 4568	4800	VortexForg128.exe	126
PID 4800 wrote to memory of 4568	4800	VortexForg128.exe	126
PID 4800 wrote to memory of 4568	4800	VortexForg128.exe	126
PID 4800 wrote to memory of 4568	4800	VortexForg128.exe	126
PID 5604 wrote to memory of 5340	5604	CircuiTranspon.exe	125
PID 4800 wrote to memory of 1728	4800	VortexForg128.exe	95
PID 4800 wrote to memory of 1728	4800	VortexForg128.exe	95
PID 4800 wrote to memory of 1728	4800	VortexForg128.exe	95
PID 4800 wrote to memory of 1728	4800	VortexForg128.exe	95
PID 4800 wrote to memory of 1728	4800	VortexForg128.exe	95

C:\Users\Admin\AppData\Local\Temp\CircuiTranspon.exe
"C:\Users\Admin\AppData\Local\Temp\CircuiTranspon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5968
- C:\ProgramData\AuthWebhook\CircuiTranspon.exe
  C:\ProgramData\AuthWebhook\CircuiTranspon.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\ProgramData\VortexForg128.exe
    C:\ProgramData\VortexForg128.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4268
- - C:\Users\Admin\AppData\Local\AuthWebhook\memu.exe
    C:\Users\Admin\AppData\Local\AuthWebhook\memu.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4740

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:3544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbef59c728,0x7ffbef59c734,0x7ffbef59c740
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1268,i,7703356663327498967,14030534694072519124,524288 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2008,i,1943124948156719661,14718098662147537981,524288 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:13
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3056,i,1102915745586925890,16265298512858325830,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3052,i,16506165495342632310,4362839584440264692,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,14973686361005037041,6286530791176930644,262144 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,9445208292966942844,12657875220031683105,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,8560588680425427588,16579139688352484571,524288 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4940,i,14910419277071354906,1109158053034090750,524288 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4912,i,4402577764517523391,2376151045052384373,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5504,i,17156493827082840830,15771481441832184327,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5772,i,2199743672608703651,1939823081358514521,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5908,i,12090048411914629588,13343501539910194722,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6008,i,4040535190874392916,5374358179643329523,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6048,i,15349543516890745922,1424056841694152691,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6332,i,3442208941707948271,16460785092895439319,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6280,i,8964064042747822361,2930307121071856528,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6592,i,8194253790455951014,8289036226483315237,524288 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,12564408798883868150,13884378834146694466,524288 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6860,i,2802637571726444176,17588517253036927231,524288 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6172,i,15280850012752057563,10166066317990520001,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5908,i,15807883386054088035,5077136387264439888,2097152 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:9
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,18059218028509672977,9172108019362208466,524288 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,14670358579807343891,7411031234168761922,524288 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,5153691660432102032,431201116295675448,524288 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6352,i,11274608860880700034,11579258641752423743,524288 --field-trial-handle=2304,i,3596731107068452093,10841141512737441837,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3108

C:\ProgramData\AuthWebhook\CircuiTranspon.exe
C:\ProgramData\AuthWebhook\CircuiTranspon.exe
1⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5604
- C:\ProgramData\VortexForg128.exe
  C:\ProgramData\VortexForg128.exe
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5340
- C:\Users\Admin\AppData\Local\AuthWebhook\memu.exe
  C:\Users\Admin\AppData\Local\AuthWebhook\memu.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BCGCBPRO1100u100.dll

Path C:\ProgramData\AuthWebhook\BCGCBPRO1100u100.dll
Size 4.7MB
SHA256 e650ae0d297b0de8b7a708003dc07e5a5ed7542b39e0519dcc11be582986117e
MD5 b560e9da72827308c322f8c18c76617f
SHA1 100e0c71d2890bc5ce600768e31c6c6b13f5695d
SHA512 dccc1ad8ec97f559ef09f3bb245daa82defe558ec561c24512c08b0043851271cc54d09dc46216385f09afadfa287d86ff65061aa8ff0da0ef11adaca80e31fd
SSDEEP 49152:inJn0WQqXU2JY33XK2dMYD3rzMwbzUVujdhHVUkdpRlHtgvDDyQkmMbJxY9XZ+x:inl0WOlK2Gw3fMwboVuH6kXRR
TLSH
T1C1367C30BE7C027AC5DE95B59E3E366F4D5EBD50472842C75168385AB870AC23633E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CircuiTranspon.exe

Path C:\ProgramData\AuthWebhook\CircuiTranspon.exe
Size 108KB
SHA256 5d501d3c51576a402a301470f7bf919b87e0f8a0ed40172dde3d7c1c622ccdc3
MD5 a3d2a2cdfe0f51e0194de4e66f5a4e59
SHA1 9e74abf1cb6ce8d4d8fd1a564fac9dfa3df806bc
SHA512 5cdb2276cc69fff03ae7ee7566f46e3fc0603d0f7e0337f39f089ebdfa4563cfa6cdb8c83c3839c5767212578cc195f87d19a903ed50e26c7ca6643db5489005
SSDEEP 1536:5x38QUYa1eDrFhKweJ13+V7XIw9mBiL5axtuA4Bd6JVoJGLn05UuiFCMR10NTkGr:PDijCUfjyMr17C0IEnOnDLCg/taX21
TLSH
T1DDB33A21B7449827E972D1776AF8FF294A2CE0B0479110DF72682DCDA9709D31D3A1EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateMiniDump.dll

Path C:\ProgramData\AuthWebhook\CreateMiniDump.dll
Size 26KB
SHA256 f6ddce7554a0d1b9786ee1822cc026fe97be5b4778ecaf349843fe79769907f6
MD5 49405ba66b7a666c379a0e92812d05f5
SHA1 7017394286c11c4cdab34ea3cf96fc7d79599149
SHA512 bd3533d53ce77fb9219854992d1eb505859253726bdfbde8704272f4047022c5aa1ac1f6ffb439fdceb291f435a39936365f3c1085e451254b91f150f4d5f72e
SSDEEP 384:P8IvV5BgO/P3f/VinPVPL08AIYikHKKKUe8JN77hh1ZyHIYikHK1e8JN77hhEX:P8A5BgEvYndQiYibUZ3h/ZyoYib3h6X
TLSH
T106C26CA60A5A4422EF9B4EF071E0E3761D7876D677D090EB6258C1560FC47822B683BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FeatureSwitch.dll

Path C:\ProgramData\AuthWebhook\FeatureSwitch.dll
Size 62KB
SHA256 9023552a39117772e5d44c52deef13b1066825f49b538c3849f6c7192091b711
MD5 5ca0ba3dbf6e8adeb99f1ed97cc3123f
SHA1 5af6a411b275c26365b7bc11f6922e5364aa8a28
SHA512 5a64def2f357038a03cdfc8913dbaa06da9a2d947f18733df9dc6cd454b70f5eb1cabd4d6b342ae7bde2f00fddc9293135a48a99b913d18f271a9010b67d2d22
SSDEEP 768:1yyiUPdWUUUWhvPNgpf4YYA/Q1K6h053antEDpm42jFy5vynA+QFAChYiAHfY3h/:0wvBuA/9mEk7ZtnA7ph7j3hCH7c3htz
TLSH
T113537D0565958033F3E35E382AF4E2B94D7F79422BF1508F2B6905B94FA17C19A3837A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PPUtilLib.dll

Path C:\ProgramData\AuthWebhook\PPUtilLib.dll
Size 300KB
SHA256 178e832158c7fb2fffbeebb26b2a0ce35b710731b7cad51a600cfb7fe03a4fd6
MD5 ccb172f4b6dac0374e203b9e90342e29
SHA1 04473b0dcbe13bea53cbc90961fab9b206441f5f
SHA512 dabe7b182ef06fc2d61886b568336fb03cce69431c045fc9f0ce0219d4967369d651f15e3c3c966fc538d89eba814d087eb817e5d95bbab44673cb3204586748
SSDEEP 6144:wKg3kdXZ9g1Vg+kIWxpZ11OZhsl+KFJqzD:Ok/96kzpjFl+MK
TLSH
T15E647D207A568E37FAFA02349EBF661655ACB9100774C2C7E34C9E8EE8315C3993574B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XMaxUtil.dll

Path C:\ProgramData\AuthWebhook\XMaxUtil.dll
Size 79KB
SHA256 5665023d6154010e09c38da961fee756abc5d0673dd62f9b9baa0fa70697f4bf
MD5 0ec5fd79b9693951a807b6685c85ba01
SHA1 48b843d2ab1fa7e7518ba4a402972539796dcec8
SHA512 81d89b788de920da59a054e8440dedb2665356be46f6f3fe0dcaa4db98960870a8a47492c48ac40dfe14783bddeb8e08ebd2e179ba0c554ef41dd408add69a99
SSDEEP 1536:KC7rwJtwGQj8CIw5Up5wo6nJp2Zh89MhCbV5OGpwwJfmMMwoT733hNr7M3h6A:KCJ4f6nD2ZaMIbV5OGpwwJfpSXrR
TLSH
T1A6835C527E198422E6F6057079BC6B6E383DB2622BE500CB53171A4D0DB0BD3BF78756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maxcodec.dll

Path C:\ProgramData\AuthWebhook\maxcodec.dll
Size 110KB
SHA256 e4d065c0eb2e9d2212178a928365aeb1b7fcd4f9ee130fbfb9e5e797813c891e
MD5 afc0e83ab3f9f1f045e7d0e55cbe2a0b
SHA1 92f86b237bee8e83034904456ddace056d1b9d62
SHA512 4e49852054b34fbf6afcf2a40fe769c580660911dcd98bf05cd7555880dd872591cee39f34169a0628641abe5d3380b5bc91d9bcd23ae1d97e456b7ef1f44edb
SSDEEP 1536:DI1xxpkfYLtPZdjKL/VUPy3I8FPcoyIO8PjG35OS7xIy8qM7l3hZY7qL3hl:DIhp+YLtaLN4y3ioQ8Py35OS7xqNxYE
TLSH
T1EEB38D12F6818033E5F7067AA8FE9B7D0A3E70648F9610DB7B8467995D205D31B352CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maxkernl.dll

Path C:\ProgramData\AuthWebhook\maxkernl.dll
Size 166KB
SHA256 44caf675bc2da0a7496f9be90d2aab44b7f29b3c4e3b10a569ba103d4ecdea0f
MD5 f7a87b4f13451a4c3557326a9815b141
SHA1 80ce39bf3646624dca077aee97f1b01ac492e07f
SHA512 d7b999fed0ecd10127c18a45ddb7b8f0be2a0f04581fb7a1d3e09626e05a8658b1b6d794cd1149e3f84c2536112cdc42284dd5e5073168bd74a3998d0cf7a09d
SSDEEP 3072:xIpzfcRp2PavbRfOs7EaWTIEkrUiZLxGy24Qw8ajOJN5OtZo5:EzURp2Pat97ErUEkrTZLxipN5O85
TLSH
T1FCF37D21FA41D23AE9F70171EBFF2A9A287D9536033444C763D80CAA5D709D37A39297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maxrast.dll

Path C:\ProgramData\AuthWebhook\maxrast.dll
Size 157KB
SHA256 f39c0e4a85171484bade6171f4be8b2951e5de7c39f041160b9da2a44f4220c1
MD5 056d60dbbe43ddcf7729937319b75578
SHA1 643695ad727732d592af8dc4b9ddc10db18667f5
SHA512 d2823f0c228c14444c27f2c3264b5fc80f0651d5cb5594e974be4942ec5665aafbad7f1bcf92359565a54e92638582c5b646c6477621b8637273a766bfa5f0ff
SSDEEP 3072:0FJ2JIbY8XzQA4oASEl6N2Ld8Rj+N8IUpgtH55WEXmK+6jTdyAi8LuL:0FJ2JIbNzKff6UJudJsHn/2K+aTHuL
TLSH
T1F8F38DC2F9529E7ADADB087ED6AAAD3414EE0313077701E73665C941EB407C32DB528B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc100enu.dll

Path C:\ProgramData\AuthWebhook\mfc100enu.dll
Size 54KB
SHA256 ee7d56095c1ccaa93fb2e86ae9381f77cc60cb332dbdcca49da63896349f98b8
MD5 3cf266ca615e03dc6c2afac0443d606b
SHA1 92aed0a7811c9ed1eb1a5b87b296253b010ec962
SHA512 838ef68081b91ca0c3dcc9e095fd472681c4bd23304b8b90a8d7858c06d848ffd8f41ddeab32e504741a8ebebdc1515d47eef5b31179fd95be3b5c69a60881c2
SSDEEP 768:HgIdijcuEhCgy4Y6B1CLPLNq5f/nWHBNheOU2fd5c1viY+w:AI0ify4Y6B8PLNYf/nWHNTd61vj+w
TLSH
T1D143736263F98605F5F77F752EB546605E3ABCA2ED38CA0E1640614E0972F50DEA0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc100u.dll

Path C:\ProgramData\AuthWebhook\mfc100u.dll
Size 4.2MB
SHA256 515f8c3683c36ffaf64d01693bb83eeb1f0dbfddecf95ec4d7c3f08e7f00c0dc
MD5 6358cc2a77f3c12c5b9b16190d5477f7
SHA1 47ee1895c6e11248fa6cd2a594f6395335453d35
SHA512 8eced5237cbd287b8a66044580b60fedf2a324ba377b2ac1e332f5bcd7aac6b212e9c4da1cd5f3b1aeafcc313da80040e634e05fccea60f803aaad19a18e6e7d
SSDEEP 98304:ZhRRni1aewd5ZnDRB+5sCpffcU1jQV7jztl8bo1pKkXwLNVk7hERtCDJFLOAkGkh:Zhi1/2JIg9JFLOyomFHKnPAK
TLSH
T14D268D227ED990B4CDD321B0469E7679A26EECD4273406C351943BFBE9743C16E3898B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp100.dll

Path C:\ProgramData\AuthWebhook\msvcp100.dll
Size 412KB
SHA256 cd28daeda3c8731030e2077e6eccbb609e2098919b05ff310bef8dce1dce2d8d
MD5 ed40615aa67499e2d2da8389ba9b331a
SHA1 09780d2c9d75878f7a9bb94599f3dc9386cf3789
SHA512 47d94c5f4829a0f901b57084c22b24adefb4aec2f7b8df9ea838e485dbc607aa837ed6d3c7186159499c44a3ff488fb04f770c624649a406854d82cd3baf72ee
SSDEEP 12288:AOb8zxr1aWPaHX7dGP5HrhUgiW6QR7t5qv3Ooc8UHkC2ebe:AOb8Fpa6aHX7dGP5Ov3Ooc8UHkC2ei
TLSH
T11D9428237A4649F5E1D223F46289932143F9FCA40721B3C3E2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\ProgramData\AuthWebhook\msvcr100.dll
Size 756KB
SHA256 25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8
MD5 ef3e115c225588a680acf365158b2f4a
SHA1 ecda6d3b4642d2451817833b39248778e9c2cbb0
SHA512 d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a
SSDEEP 12288:amCy3y9cSWI5vMBEWL3XU8+n6ODOlMFgvXmteA5RLTDz7sHA9p++/pj:amCy3acqvM6WL3XU8+n6ODxgf4eUH7Tt
TLSH
T1D8F49E11B692C073C17221300629D7B25D7BB9711034A46BBBD99F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90414368564b6a2c5bbc811852bf1c02581b135e

Path C:\ProgramData\Deyanavi\Licihisu\90414368564b6a2c5bbc811852bf1c02581b135e
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

VortexForg128.exe

Path C:\ProgramData\VortexForg128.exe
Size 546KB
SHA256 1d1d2245651632f1fce464eda9d5c5ea6ca43b4a04424601ce8c890951111028
MD5 c39a4cca58bedd9b3ceda4d0d3e1e94a
SHA1 0ea31e219e83aa4ba169ef2a132af8fb52f54bf4
SHA512 673794aee7f54a6a1191069a1647ff085c8da6c9bdcb8e358e9969c51c9782993c5e73b938bb4388af012a6cb279e1faf324af55c49748a85b8159c170f4252f
SSDEEP 3072:BBPlwpY3YKF0MrrJq+DNBg0DJtOJs9cAg0Fub+A5aiMqKIDqLqprqpB:rc2XFRJ3DNuzAOS9F4DqLqprqpB
TLSH
T199C43821B4C1E47AC862073008E9E6B57579FC215E72863F33F47F2F3B762816565AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Local\AuthWebhook\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

126ff7ee-40bd-48a3-8a58-b7ed33f852fd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\126ff7ee-40bd-48a3-8a58-b7ed33f852fd.tmp
Size 141KB
SHA256 508aa46e856ba435538813cb418a2c5cee80b82c0631c7f88703a92bb557dbe3
MD5 83f3695799149d011b0c5aeffd49920f
SHA1 eb644f3c7cd933dd8ea22aff98540e34ff116578
SHA512 d43b56fc366118d4af2878cfab14c5a92710d030a4e4b74d5b59db1e30c93ba130aeac34d1e93db75945a04a7a6cba70e6dbea80668a88d945d9ab8af64b0c0e
SSDEEP 3072:NQ5IV4sc9gXbIibsYAr9DyHsZwaE5s9AHcDZsUK+pqC3fY:NdV4sqgXrsByHshkU70
TLSH
T121E31333F4BADEAB8438D4EA100D37168E23731F3415EFF546E85D451A985E89F5B062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a9c0318-4567-4b3e-a4de-e0e6b60a53bb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7a9c0318-4567-4b3e-a4de-e0e6b60a53bb.tmp
Size 4KB
SHA256 e3453781e1397ffc6dd629a85fe90e7e4691af3c3b50552c2b3d6db0c2a03c03
MD5 236da02b98b33638a369fc0644eeebce
SHA1 bc642a9608c3e4b3b3e84921a50c933e31786080
SHA512 e818503a941bcba9530db8ee118e1ee65febd3632cc450c830bb56f21d3eb087470d8867ccb688a98bcfc342672d135513a3c2b6be12c72579965cf8e267e4a9
SSDEEP 96:mC0d+ePqUvKD1H31Luf6NQi4DpniRDotok5ZCDBB6bdGyvC74MCjb2Hv4a:mC0VPHKDFQvSDUDe3Uwl4MCjb2D
TLSH
T1FEA10931A86958B759B6D98AB4453A43CFB8A277E561AF44D9EC4F0C11FB0EC1382633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85f74f0b-7ca7-4b15-b75b-fc450f46014a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\85f74f0b-7ca7-4b15-b75b-fc450f46014a.tmp
Size 140KB
SHA256 04da2c82efbb4b186dd2682ddcee131abb3f97707ba29253e364396d7c0cb5cf
MD5 ce219235901c4a83b137c86ff69a0fd7
SHA1 3c60be771dc6d2580378b2f392331c3dcb061fea
SHA512 3f2f38bb25fbad83ccd26550f33dd13e3714a8d041eecc60ffe0658dabb9bfcaa4bb2f933b96fb20e2468972a71499245a92333fdfb25c087dd5813200c3a458
SSDEEP 3072:NQQ34sc9gXbIibsYAr9DyHsZwaE5s9AHcDZsUK+pqC3fY:NZ34sqgXrsByHshkU70
TLSH
T17DE31233F5BAEEAA8128D4FA101D76178F03730E3011DFF642E48D562EA95E84F5B062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a9a7e7f-c8ba-4f67-9fd0-6d31ab949b45.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0a9a7e7f-c8ba-4f67-9fd0-6d31ab949b45.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4a4127ba-3cc3-4f83-9dfd-c77da352c477.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4a4127ba-3cc3-4f83-9dfd-c77da352c477.tmp
Size 11KB
SHA256 9777c2a421a9b608ee7794a2bd73d6d8b658fdf6551432f86a754b3c2e38d542
MD5 e03d4069d9f41073e2531b3a44b22b66
SHA1 3df7ce2be466c47c3e27f223a66019a57540cf1f
SHA512 7dfe0c858193d534c67c5666ec8877fa349465f0ab315bd456641bb231858ce7557cc86428766c7885bffaef3268e6202939b775a428060c676cacc010034df3
SSDEEP 192:YRmeD/Nv7sAPRp2F9KHsb+WNnqp0fkCjkwJVmVyIsnAUge:YRmejtBXOowM0ftpce
TLSH
T14632822DAD18797B5CDBD31EEA667752E3F9102161942F84EAF8CA2C10EB5DC2327017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ecd7300-f624-4701-b320-6501000a56bc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6ecd7300-f624-4701-b320-6501000a56bc.tmp
Size 11KB
SHA256 85d41262479dffb9b0a4e1c3cbe241880a0da59edc506e626223a3169d0afbbe
MD5 7acde4a0596160a5185281236a11eb59
SHA1 5ec7844e88167fc2121ccb89ab185f18a91e22d6
SHA512 07a4d888b80351163e1e966e4d9339ac44cd03c1b83f1db8e71419e9e09d35caab7587f63111868eab9885e080db7ec9bef0f0f949f7ffcec2abbc7cac288b13
SSDEEP 192:edy4K6337KxkXqK4I40pUZNCgVLHrKHfFKslENVzXzKD/c7+ErUkKN9kLkw7v9ei:IyjE37KxkXqKf/pUZNCgVLH2HfgslWzF
TLSH
T11832C71BA88D5E3F4FE8E55DCC126F8BACF4025672680D2852FE9D0503A578A124A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88c7861b-d2ba-4cff-b8b1-9d7a20789a8b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\88c7861b-d2ba-4cff-b8b1-9d7a20789a8b.tmp
Size 11KB
SHA256 bad7b895dea672bd5b382fb4e77b07ed278e95aa09dc18bef8af982be0b91bb3
MD5 3a92b01b788b163ffdd5ef393df25b2c
SHA1 127af8f94374c1252f75499869e0f2811dfddacd
SHA512 8a52551a9ad4bb603e5fe8139375a4b9062c330c180c3beaa97316bd9f997aafbd54aa9d17df40579fd972f9e2b715ab730e4da08cb366ceb0c555c4bd93d1ca
SSDEEP 192:YRmeD/Nv7sUPRp3F9KHsb+WNnqp0flCjkwJVOVyIsnAUgE:YRmejtdX1owM0fmpIE
TLSH
T1FE42722DAD14797B5CDBD31AEA667752E2F9102161902F44E6FCCA2C11EB5DC2327017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

179a9c15-ef49-47bc-b1ba-4da7e4187f88.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\179a9c15-ef49-47bc-b1ba-4da7e4187f88.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ff2a8a23-4565-4132-b1d5-6c5ffdcb859a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ff2a8a23-4565-4132-b1d5-6c5ffdcb859a.tmp
Size 2KB
SHA256 13d8331e7a04986b17ef96df36d32f50c40cf615b1ed9564cf1fe0897e0e4bd3
MD5 ab252c729335ab33f43b66e92e1c0869
SHA1 087ce86d61e9459e8b91db9b6ddafca8bf0f4144
SHA512 f7acda6987b2dd02bb40c65ee6dbe122f030f0217353d006a95db1f63828a8d665d3d629b1714dd977c9b9f6e287bb38eca09fb51b0c317dd4f4280b6d80f4ee
TLSH
T1F4518AB3D3D4866DC41156F49B257E2FCE2D0A28122D3C56C9D8AF5F53E28B2D21134E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 0890813136f0aec1e3de4e57c6032d64e400614b3eb0852d6754da966fcacc0f
MD5 6ed959a281a91dff30a53bd9f74ca360
SHA1 ac28b2384f8fc6e0ddb9b5d9481087ab4c03909f
SHA512 9ebeb2755c3ce3b46d9defad25300018366ea3855d8397225413bf83712d13bd89e75a73a870c3cc865b33575cf06cdf8393bc689f359dcbe30b64e06fe13db1
TLSH
T184A002D445D01CD1CD19527464613653735B99141551434798D58448EC5F5C18211610
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 4c67c6f128e2423b6bae036f25d07d54d60d158eafafac0f8478584847f19314
MD5 3318a462f566efe171cd52d8c88f21ec
SHA1 1a4075fc46b1d2e81b591bc69512b011c89fa393
SHA512 6ea9d2ef9f136f1d9c1f863efe349700c5cf1ed01544414557e31be57c029fafa08fea12cda33055eccfdb8aba67a67cec83505a5a7ad5710d19fd868bfcb967
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 140KB
SHA256 0f9df3c1df18357238b870b1719951746c7fe962e45a4fa0cff22f936660333d
MD5 5963fe8589e9c59cb0643812830aca9d
SHA1 97d97f58de0185e8061af990fa972f8a69058f93
SHA512 e4649c4428f5efa17661c8cf4f2e407380b489cf3b853f35af32f232b6dc710cdf1d35ceab890ac3bee5fce8915ecbac5f5798286fb39de7e50a8ee8a25c7bf5
SSDEEP 3072:sQQ34sc9gXbIibsYAr9DyHsZwaE5s9AHcDZsUK+pqC3fY:sZ34sqgXrsByHshkU70
TLSH
T1DAE31233F5BAEEAA8128D4FA101D76178F03731E3411DFF642E48D562EA95E84F5B062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3e9f1ce-d362-4730-a4e3-3d0a019e53ee.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a3e9f1ce-d362-4730-a4e3-3d0a019e53ee.tmp
Size 140KB
SHA256 3e6bc5e674dd8e6942e48ef7193a84334391fd9d7c2d2be640d7b618face9e5b
MD5 9f7a79a06253a625d477679f6519c80f
SHA1 ec93fbb142dd1459102133cd3866d06ef8d9e75d
SHA512 9e12634dbbe44f7cd96bc3e3e482e05f1e3dab2b955734b9af98f552b2e6321cb11ee3ca5d919ec60c652d34f3f6f5723bc556dfcc26be61738e3b344f52d28f
SSDEEP 3072:sQQC4sc9gXbIibsYAr9DyHsZwaE5s9AHcDZsUK+pqC3fY:sZC4sqgXrsByHshkU70
TLSH
T14DE31233F5BAEEAA8128D4FA101D36178F03730E3011DFF642E48D562EA95E84F5B062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

215BE18.tmp

Path C:\Users\Admin\AppData\Local\Temp\215BE18.tmp
Size 40B
SHA256 cb11e945bc052d6973575ef2b93d062664a073b8449b51ed27f889126958c09a
MD5 8308459ec88e71c2aea63ce396877d70
SHA1 5933919032e5c65df4d7da6b07ea33fb9d86bce6
SHA512 6430e75c9b826170cce9e53e8ba128737c94728211e4c0f61d3811f54aa710a3b7c55a7a7ac969819be2afec7c1d4a6e2ee788c2f09e91a94cef48cdae649201
MD5 SHA1 SHA512

Submit Download

AA456ED.tmp

Path C:\Users\Admin\AppData\Local\Temp\AA456ED.tmp
Size 40B
SHA256 53723656656b3f658aaa5660d15e6b3b4c954db4eb48050c1aa8da9c57d22fce
MD5 cd6f9ac009c86e055c31856d245ca206
SHA1 3bcaf43f7702ede0c45061ebf84b5c48ba9acac5
SHA512 65c0d75d8e7a6d642f742d6a1aebb6a09b6f1186976c5b4ebf94b7153a47677c7f680c9952ab8ee26619f81739b5bfac9f5aa3d16741624cc932862beed3fd51
MD5 SHA1 SHA512

Submit Download

D4C33A4.tmp

Path C:\Users\Admin\AppData\Local\Temp\D4C33A4.tmp
Size 5.1MB
SHA256 f4a3a077cc7d553ffa09428ad4b6e8a86875286a25876f5d29456db84dbb90e0
MD5 67bca0dfd594c30c8f24a93fe305b8df
SHA1 b42b33a31b49245507bb3918c01d18a44b8b9579
SHA512 bde38613888b287e1e6513aafa7d60544a12903b3679133e769281a36e34232349aff4e52cad9dde1481707ab34a63a68aeea32ae994843424dca97e998d4115
SSDEEP 98304:z8jgwnitorD8wb2HUoxWhCPc03/51UzXb9cRTKwaFvWHnyQYJf+:ogTtot2xxWhAcu/5Kz5AUMHnyPf+
TLSH
T1C13633DEE01C3553D8CF60597E41D9AE882CFA77FA4A6A221133C8A01773C796548B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DC790EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\DC790EC.tmp
Size 5.1MB
SHA256 fe9e3d70fcbb934fe3b03ae5f604f3c97652a12ccf11cd88539d42abd4329f80
MD5 a62bfcaf08780bad2dc19fa0170435b4
SHA1 4744b24c15dd75565e4e3e59c96663f36a2252c7
SHA512 cb0ba5c46f078d41620475e1221cd69310d0fa8cdc2e09797bf2d4c88a31d81333135034f4b6d8ae28fff81941392e953b2725e6a3c5e4ca9a82de77534692a9
SSDEEP 98304:M8jgwnitorD8wb2HUoxWhCPc03/51UzXb9cRTKwaFvWHnyQYJf+:rgTtot2xxWhAcu/5Kz5AUMHnyPf+
TLSH
T1E33633DEE01C3553D8CF60597E41D9AE882CFA77FA4A6A221133C8A01773C796548B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DC790EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\DC790EC.tmp
Size 5.1MB
SHA256 8b312967c918fe4b122ef2553e1a09d560c50e9fa31709ad01691dfebc505f7f
MD5 1f75660e027a6c712b4e8a3222f28400
SHA1 0f5f1247dca7b72bfa8c870dc6b4e421320db899
SHA512 305ee6b022dc4e82381c82bf423136183c90077d54bf8d487883035abe7698e8381ea895b7ed1f10350c7614761de97a09ff31ff35bc41aafe12c640e7fc2643
SSDEEP 98304:e8jswnitorD8wb2HUoxWhCPc03/51UzXb9cRTKwaFvWHnyQYJf+:1sTtot2xxWhAcu/5Kz5AUMHnyPf+
TLSH
T1CB3633DEE01C3553D8CF60597E41D9AE882CFA77FA4A6A221133C8A01773C796548B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb4513f9-d84d-4e5d-83ef-d704a55a15fe.tmp

Path C:\Users\Admin\AppData\Local\Temp\eb4513f9-d84d-4e5d-83ef-d704a55a15fe.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1728_656778657\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

yoil3U.7z

Path C:\Users\Admin\AppData\Local\Temp\yoil3U.7z
Size 7KB
SHA256 2ebcc7eec0252ee67dd36fccd1b749ecabdaace457eab04ae7d2987347952dc2
MD5 8c143afe5bc8d5e89db054ae3275e7c8
SHA1 c9748e0a5f813a706718a1b57d58ece90d38ee63
SHA512 c0dac4a986c69a2f987bfc5a689012b96f66e6c837af1c36c4396b7775a66cb1494b1bcbdd3d2737116c895e82757bc9d2aeb1dd09b03993dfa331e6719ea615
SSDEEP 192:n62AJcFoR21UVn61CaRd1QSGuwDCo+/eLeouPTZumQobH1:nfAyFoMA61HG9DCoSMeoC11PbH1
TLSH
T12CE1AF49B3D48CCEBFE64DBE8FF0EE97059B09920B642B90A103D5395519178048F2C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/976-24-0x0000000074840000-0x0000000074892000-memory.dmp

Download

memory/976-31-0x0000000074840000-0x0000000074892000-memory.dmp

Download

memory/976-19-0x0000000074840000-0x0000000074892000-memory.dmp

Download

memory/976-20-0x00007FFC14CE0000-0x00007FFC14F43000-memory.dmp

Download

memory/976-21-0x0000000074860000-0x0000000074861000-memory.dmp

Download

memory/976-22-0x0000000074840000-0x0000000074892000-memory.dmp

Download

memory/976-27-0x0000000074840000-0x0000000074892000-memory.dmp

Download

memory/976-28-0x0000000074840000-0x0000000074892000-memory.dmp

Download

memory/2764-660-0x0000000073ED0000-0x0000000073F22000-memory.dmp

Download

memory/2764-656-0x00007FFC14CE0000-0x00007FFC14F43000-memory.dmp

Download

memory/4740-55-0x0000000074840000-0x0000000074892000-memory.dmp

Download

memory/4740-48-0x00007FFC14CE0000-0x00007FFC14F43000-memory.dmp

Download

memory/4800-37-0x00007FFC14CE0000-0x00007FFC14F43000-memory.dmp

Download

memory/4800-51-0x0000000000C50000-0x000000000100C000-memory.dmp

Download

memory/4800-38-0x0000000000C50000-0x000000000100C000-memory.dmp

Download

memory/4800-96-0x0000000000C50000-0x000000000100C000-memory.dmp

Download

memory/4800-33-0x0000000000C50000-0x000000000100C000-memory.dmp

Download

memory/4800-52-0x0000000000C50000-0x000000000100C000-memory.dmp

Download

memory/4800-50-0x0000000000C50000-0x000000000100C000-memory.dmp

Download

memory/5340-652-0x0000000000900000-0x0000000000CBC000-memory.dmp

Download

memory/5340-653-0x0000000000900000-0x0000000000CBC000-memory.dmp

Download

memory/5340-585-0x0000000000900000-0x0000000000CBC000-memory.dmp

Download

memory/5340-658-0x0000000000900000-0x0000000000CBC000-memory.dmp

Download

memory/5340-553-0x0000000000900000-0x0000000000CBC000-memory.dmp

Download

memory/5340-584-0x00007FFC14CE0000-0x00007FFC14F43000-memory.dmp

Download

memory/5604-551-0x0000000073ED0000-0x0000000073F22000-memory.dmp

Download

memory/5604-86-0x0000000073ED0000-0x0000000073F22000-memory.dmp

Download

memory/5604-87-0x00007FFC14CE0000-0x00007FFC14F43000-memory.dmp

Download

memory/5604-89-0x0000000073ED0000-0x0000000073F22000-memory.dmp

Download

memory/5968-0-0x0000000074840000-0x0000000074892000-memory.dmp

Download

memory/5968-1-0x00007FFC14CE0000-0x00007FFC14F43000-memory.dmp

Download