hijackloader | 83add24600d6e5ca6681bcb1bd9b2c900af4f80629443f6d4ab7da34740325a5

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_84a06ef871892c9a31c9a4a70bce6fff_elex_wannacry.exe
Size 17.2MB
Sample261102-tmp12sdv9j
SHA256 83add24600d6e5ca6681bcb1bd9b2c900af4f80629443f6d4ab7da34740325a5
MD5 84a06ef871892c9a31c9a4a70bce6fff
SHA1 d047f0cf6d887b71c67d80507385281cac270b4f
SHA512 eee8e732da5cffd750871ef3a84aa806361fc2601565ad4bb6bc9a158110f9ce425497dbe150351e9541ddb3d502ded8c6401a19b1cebdffd02f96a2b0158b1a
SSDEEP 393216:+pYwkoanZjd7S2iAiJT23JH/XZbGCUFmXQ+UVjg/:eYAIj74CuFmHUhg/
TLSH
T19E0733007334BFBEC31ADDB29F419BA246B0D58A55108D83ED924E386D83DBB115BAF5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery hijackloader loader privilege_escalation spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\com_srv_task_v2_0
inject_dll
%windir%\SysWOW64\ieframe.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c623-116.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
1488	Dispatch-Coded.exe
4256	Dispatch-Coded.exe

Loads dropped DLL 54 IoCs

pid	Process
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
1844	TuSimulator32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4256 set thread context of 1844	4256	Dispatch-Coded.exe	92
PID 1844 set thread context of 5436	1844	TuSimulator32.exe	97
PID 1844 set thread context of 2584	1844	TuSimulator32.exe	125
PID 1844 set thread context of 5436	1844	TuSimulator32.exe	97
PID 1844 set thread context of 3316	1844	TuSimulator32.exe	132

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	TuSimulator32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	TuSimulator32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\cachehost_v3_0_debug.job	Dispatch-Coded.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	TuSimulator32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	TuSimulator32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TuSimulator32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_84a06ef871892c9a31c9a4a70bce6fff_elex_wannacry.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5872	chrome.exe
4212	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1844	TuSimulator32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
1488	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
4256	Dispatch-Coded.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
5436	chrome.exe
5436	chrome.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1844	TuSimulator32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 5 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4256	Dispatch-Coded.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe
1844	TuSimulator32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeDebugPrivilege	1844	TuSimulator32.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe
Token: SeCreatePagefilePrivilege	5436	chrome.exe
Token: SeShutdownPrivilege	5436	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe
5436	chrome.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1488	1880	2026-11-01_84a06ef871892c9a31c9a4a70bce6fff_elex_wannacry.exe	90
PID 1488 wrote to memory of 4256	1488	Dispatch-Coded.exe	91
PID 4256 wrote to memory of 1844	4256	Dispatch-Coded.exe	92
PID 4256 wrote to memory of 1844	4256	Dispatch-Coded.exe	92
PID 5436 wrote to memory of 1420	5436	chrome.exe	98
PID 5436 wrote to memory of 5872	5436	chrome.exe	99
PID 5436 wrote to memory of 4104	5436	chrome.exe	100
PID 5436 wrote to memory of 4104	5436	chrome.exe	100
PID 5436 wrote to memory of 4240	5436	chrome.exe	101
PID 5436 wrote to memory of 4240	5436	chrome.exe	101
PID 5436 wrote to memory of 780	5436	chrome.exe	103
PID 5436 wrote to memory of 780	5436	chrome.exe	103
PID 5436 wrote to memory of 5788	5436	chrome.exe	104
PID 5436 wrote to memory of 5788	5436	chrome.exe	104
PID 5436 wrote to memory of 1816	5436	chrome.exe	105
PID 5436 wrote to memory of 1816	5436	chrome.exe	105
PID 5436 wrote to memory of 2928	5436	chrome.exe	106
PID 5436 wrote to memory of 2928	5436	chrome.exe	106
PID 5436 wrote to memory of 3048	5436	chrome.exe	107
PID 5436 wrote to memory of 3800	5436	chrome.exe	109
PID 5436 wrote to memory of 4764	5436	chrome.exe	110
PID 5436 wrote to memory of 4764	5436	chrome.exe	110
PID 5436 wrote to memory of 3800	5436	chrome.exe	109
PID 5436 wrote to memory of 2840	5436	chrome.exe	115
PID 5436 wrote to memory of 908	5436	chrome.exe	114
PID 5436 wrote to memory of 4172	5436	chrome.exe	116
PID 5436 wrote to memory of 908	5436	chrome.exe	114
PID 5436 wrote to memory of 2840	5436	chrome.exe	115
PID 5436 wrote to memory of 4172	5436	chrome.exe	116
PID 5436 wrote to memory of 2876	5436	chrome.exe	117
PID 5436 wrote to memory of 2876	5436	chrome.exe	117
PID 5436 wrote to memory of 4868	5436	chrome.exe	118
PID 5436 wrote to memory of 4868	5436	chrome.exe	118
PID 5436 wrote to memory of 3252	5436	chrome.exe	119
PID 5436 wrote to memory of 700	5436	chrome.exe	120
PID 5436 wrote to memory of 3252	5436	chrome.exe	119
PID 5436 wrote to memory of 3936	5436	chrome.exe	121
PID 5436 wrote to memory of 700	5436	chrome.exe	120
PID 5436 wrote to memory of 3936	5436	chrome.exe	121
PID 5436 wrote to memory of 5456	5436	chrome.exe	122
PID 5436 wrote to memory of 5456	5436	chrome.exe	122
PID 5436 wrote to memory of 4176	5436	chrome.exe	123
PID 5436 wrote to memory of 2028	5436	chrome.exe	124
PID 5436 wrote to memory of 4176	5436	chrome.exe	123
PID 5436 wrote to memory of 2028	5436	chrome.exe	124
PID 1844 wrote to memory of 2584	1844	TuSimulator32.exe	125
PID 5436 wrote to memory of 2452	5436	chrome.exe	129
PID 5436 wrote to memory of 2256	5436	chrome.exe	130
PID 5436 wrote to memory of 3048	5436	chrome.exe	131
PID 1844 wrote to memory of 3316	1844	TuSimulator32.exe	132
PID 5436 wrote to memory of 4212	5436	chrome.exe	135

C:\Users\Admin\AppData\Local\Temp\2026-11-01_84a06ef871892c9a31c9a4a70bce6fff_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_84a06ef871892c9a31c9a4a70bce6fff_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Users\Admin\AppData\Local\Temp\Dispatch-Coded.exe
  "C:\Users\Admin\AppData\Local\Temp\Dispatch-Coded.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\ProgramData\com_srv_task_v2_0\Dispatch-Coded.exe
    C:\ProgramData\com_srv_task_v2_0\Dispatch-Coded.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\ProgramData\TuSimulator32.exe
      "C:\ProgramData\TuSimulator32.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1844
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2584
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:4984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffea2aec728,0x7ffea2aec734,0x7ffea2aec740
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,5524269322073084140,11246491111354584458,524288 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,9077239556835063748,4981531476510325632,262144 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,973240916753014664,15017441374518921211,524288 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,4503451753572118710,17033869064808242711,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,9693913433220349298,18079188942090614260,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4664,i,1786519563256617483,5262477259995025102,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,7948010421866377850,1203346259098032801,524288 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,18027168218521878674,6628697815596532936,524288 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5716,i,1893126491294337236,14979899345138679912,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5764,i,6783632049681524239,3995765682885896936,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6176,i,5940998128032994179,736182262988996130,524288 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6080,i,13942562893819646174,5545970009904902733,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6084,i,5738719746468290297,6052522499378243051,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5792,i,8850471951772839550,14102520907144599056,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6492,i,12132723215832544434,17928832592822377640,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6732,i,15646992928096211904,9289580080872431244,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6228,i,5980991658116152879,4949137555660123953,524288 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5632,i,3274006196087887669,18354028366585257299,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,4106139713545593562,12877301555604479837,524288 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5376,i,14151113482794280227,7995598808283181631,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6464,i,9008680541368212078,6700551180838971539,2097152 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:9
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,4896091690112275186,16515893034449950176,524288 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,16071905446875982366,18088963014531696844,524288 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6404,i,4189847448258683008,1242497805630970271,524288 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,5368166190448650466,6974394753598252854,524288 --field-trial-handle=2032,i,9230149298080258821,11433256385600874487,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5a102129a9fc96a484c720685e7ed4a42ef99962

Path C:\ProgramData\Jovise\Cusak\5a102129a9fc96a484c720685e7ed4a42ef99962
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

5e097336-3f23-4f7c-807d-b4987112469d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5e097336-3f23-4f7c-807d-b4987112469d.tmp
Size 143KB
SHA256 db5fface99345035c560af8f44e875822b5b2b02cfc1389e5a2bde6676115694
MD5 bd5ad072a0a94e362e860946610f64b3
SHA1 c78f04941be84f1eef6872ea2db972f049093fc3
SHA512 213a9f434a9225e56fd402ddfa3bf435683369989fb5cef5141c780a750e804a60b0a522e377617482e928d75e5eb00886e4dedd2eb8e6bcd8ec9cf73f7b3299
SSDEEP 3072:RsvHWedSNVHKzDm3o2+9Uf+0neqlWp53ESoZ9pxOLNT2:RsvHWe40m3otUf+8Wp53EX9pxsNT2
TLSH
T192E3126889CD6C77AEE881AF790BBE075F6C4646A255CA101EF13E0F3616CEF0663170
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96f7555d-e4d0-4e1e-b173-c93c438370f7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\96f7555d-e4d0-4e1e-b173-c93c438370f7.tmp
Size 144KB
SHA256 48c33fe73a7dbc6d8559f33f4efdededabcb648a3d5e82a4709c0f77807684b0
MD5 26a8681a1524d27a815e12fbcc185c95
SHA1 64394f20bb92e90196efee57906126cd0b42a8dd
SHA512 adf5351df6ee1762c418d1cc806014dfbbe02a03e6de883ac8f11aca8d5eb53aaefecf14243e9273b06bcdb4fee2cb9209eb23aae0152f39d15df6a38ee4894e
SSDEEP 3072:KpvHWedSNVHKzDm3o2+9Uf+0neqlWp53ESoZ9pxOLNT2:KpvHWe40m3otUf+8Wp53EX9pxsNT2
TLSH
T176E312788CCA6C7B9EF8419F390ABD171EBC8B47A215C9507DF53D4A351ACAE0A63170
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ae766d4-c063-42e6-84b6-62e47fcd6af3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0ae766d4-c063-42e6-84b6-62e47fcd6af3.tmp
Size 11KB
SHA256 f6c559fa9b1df2a9a9dacba0eef178e45e6272c9fe7bda66f002933ec55d5a1a
MD5 2c1570bba234de407011cde919c8dfef
SHA1 3b81df0dc5fcf1ffaa0ee54ddbd00f11e89a80b5
SHA512 8bd3830434a65a9ecab05d7760f059c894786dd3b0cfbf6be6be3cfd190af1429d7815cd9d845bee5f38a87d00afd058c55529b06d9ffbd319c41656dd6f4381
SSDEEP 192:URo3vg6aemv7ivaAPRp289BHsb+WNnli0d22u6/za4d5VyIsnAUge:URSv5aeSGvbXHDwM0I2u6base
TLSH
T11A32B62EAE14793BACDAC219FA627753D6F5102534D02E84EAFC8D3C25E75DC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7569da0b-0970-4985-8995-9c2c969d0e0a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7569da0b-0970-4985-8995-9c2c969d0e0a.tmp
Size 11KB
SHA256 adbf8d787601e9b9a1bc4ec0b0f5a7ca3d2199a7c9e22843f86af241e7089de5
MD5 e6ccb7fe010b33733f54d679d10315e1
SHA1 71f761faffc203a9c8476c2eb938fdbf5ad3790b
SHA512 20a99d03fc4be55cbdab62eba9b265cf53f6becd30f9424766a888f5c5b10ea56f623ab68e8de2d8f4b7448d59b677db054de14b3a4dd826bc5110e0ea57f67b
SSDEEP 192:ekEhc4K6Zx7KxkXqK4I40pUZNCgVLHrKHfFKslEhcEh1XzKD/vEhd+ErUkKN9yot:Y+jSx7KxkXqKf/pUZNCgVLH2Hfgsle3Q
TLSH
T15132F927948DAA3F4FD8D50DDC166F4BADF4029672780D2492FF9C0803A97CA114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

1f9b95da-1cb6-4318-a86c-749a53b1174c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1f9b95da-1cb6-4318-a86c-749a53b1174c.tmp
Size 2KB
SHA256 fb0b50dd3a767ecfd6e188d26eca8ae464773e96de5975f905ca8ed869627fab
MD5 f84da876c58960710631b5d8576e1b91
SHA1 ac81fcc3f430e3b8ea2027668d3e374569524117
SHA512 b1993dc1bf8f706197e1aca279433501854dfa115f3d16201e202f6e44aefa7fc97a05e93253328f46a5b4016c198fad3380cfa7b616400be4590a641f959b97
TLSH
T1EE518CF3D3E4C56E891156F4DB216E1FCD290A25521C3C6289D8AE4B53F28B2E35138E
MD5 SHA1 SHA512 TLSH

Submit Download

f91c8bcb-2335-452e-9ac2-24e5ac1e1222.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f91c8bcb-2335-452e-9ac2-24e5ac1e1222.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 0f6b9b0a938d8bf2e039166ac264998eaa3942cd2d2ce7bcfc916b23ada940d6
MD5 fbd8a6795781628f4388f77ccb35bb77
SHA1 89b748b3017058165b81f2b263dcc086f38f0702
SHA512 9d0bcef864308a2df28d18675be591af33b7189b83fc5d046fed805cfdf697cda8e8bd0d5b849cabcf55d3e5d9cb1f77435478a8d48ad394bbcc973570a8c245
TLSH
T19BA0021171C01912DE32D370617319C122A5691C19FB7357599148FA885B1D58111204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1cb2447d77c00b4e4a6ae057fc751a982ebc5eaeb34175f822fef605b4e3cc09
MD5 56e63ca881a984e8503a72c6ece3dbea
SHA1 7a7920a5db35f3e0ef56530f61c29f4f8df080b6
SHA512 565aad69edc8e93f074e7fc97a88f23cd973e1b06ac0134c0dd6a5bde895f2959f5db37f10210e15728cfd15263f65a74ba51d4b42db451ce2de3a953e029f92
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

aee2115f-e4b9-43eb-842a-1dd1c2f678c6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\aee2115f-e4b9-43eb-842a-1dd1c2f678c6.tmp
Size 12KB
SHA256 e0c305a23ca81979c46cbb58a353c53d76d62cd57c0ed2129885441a4a22c138
MD5 f3a086094be104637f1750804ef397fc
SHA1 33366beed3ae1fe153d429f641d6b67a5ef61a24
SHA512 2f1efe5dfd2019dc1ee73cc3ba1911a1b0a58e7127dc084109bc1ad80e7db0286f5ea3b7abada48e9cb5c344b9916cc1632a9f3e0475548e7e137790cb075fdd
SSDEEP 192:URo3vg6aemv7ivacPRpK89BHsb+WNnli0i22u6/za4dcVyIsnAUgE:URSv5aeSGvzX7DwM0F2u6baJE
TLSH
T18642D72EAE14393BACD6C619FA627B13D6F5202534D02E84EAFC8D3C25E75DD221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3989fa6-33c6-4e62-b5bf-cccaaa6dab96.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b3989fa6-33c6-4e62-b5bf-cccaaa6dab96.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

b41fe045-73e9-43a1-9452-51726ef347a1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b41fe045-73e9-43a1-9452-51726ef347a1.tmp
Size 4KB
SHA256 9b04ab9fc1265a0e6309215781e80a84673a22b3d21d0127cb19c12a92de355e
MD5 523a5b7e4e64e2b8f5a3a385464fc086
SHA1 99bcee1cf87e6010f84dc77dd53edd08462917cc
SHA512 afd16f9904e53d4b8bbd7aea63aa6b41f9b7e860b374f161671c53155d4845cb2ef4b97b7ad0bc55f637cf7a20f997fdc1077038e2c0e6d514fc21b8ada9cb59
SSDEEP 96:JC0d+cQXKGYXddbIfZMT4hJ+GexRDotok5ZAD5B6DGyvXi9KfbPzv4a:JC0/JXddkhVaDUDsfXb9KfbP
TLSH
T193A1E970986D9D7B58B6C989FA433F03CFA8615FA551BF84C9DD1E0C11EB1E81382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8118de5-282c-4af8-a808-0044db5856e0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f8118de5-282c-4af8-a808-0044db5856e0.tmp
Size 143KB
SHA256 60dc0c59d7cb88ffb5a4c187c2cfdd64720555105d0adf8bf5fd49cd3a1b3106
MD5 f455f0fc21a7c2ab126417d0707b4c29
SHA1 ea04fd3148cf46100ffcb9c518fbc2fcb19cf8e8
SHA512 65e27fb7ff8ebd774ee29db886812a0e81a48f1044cc578c50a29345ddd83ccbb099da67cc1226f52aea7f2853f990f13037001d2f87c1e42d93a1ffd0cfdc9d
SSDEEP 3072:gsvHWedSNVHKzDm3o2+9Uf+0neqlWp53ESoZ9pxOLNT2:gsvHWe40m3otUf+8Wp53EX9pxsNT2
TLSH
T16DE3126889CD6C77AEE881AF790BBE075F6C4646A255CA501EF13E0F3616CEF0663170
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cmmlib.dll

Path C:\Users\Admin\AppData\Local\Temp\Cmmlib.dll
Size 3.1MB
SHA256 4871dff464c202ab21a1281ab6ebff4d632ca996b4b198c8ce36e8c5b4ece6d9
MD5 dc4b10e6a1efa581a34b622a9018fb62
SHA1 370f474fbc7223f5a2b539866d0fb4a17e5fcf91
SHA512 586dabd2db2296acf4e0c00915974f6e3218d59d1417f15d5834d9739b3df9e0605e1786996d57c8865f2fc1a56eade0e58a295d8e3ab824b8412e59fff65050
SSDEEP 49152:22xxRI7VEEVjQdgXNzDQc58PBXULYUjaHGmloHze:IPkOXQnZlee
TLSH
T106E56B17BB19881EC5AAE27CBC577E06E6B371455326BBEF428E0A521F977C0097C780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dispatch-Coded.exe

Path C:\Users\Admin\AppData\Local\Temp\Dispatch-Coded.exe
Size 607KB
SHA256 908c3398b995e43e0e09a87954da3369c41a9d51ca90987e84080f370b62c179
MD5 b2a0e507a8d7960491f39b6c2f0364db
SHA1 945c9399026000cd1d726992ed923d5a20197370
SHA512 accb6513d21c2b0e67bb26ad7989ad158d579dbc620dea6cb52093716907a8dcaadbc371d3f7050053b8c6d0ccf8eb7ac0b119278db97a9dbf9f9bbcd82c21e2
SSDEEP 6144:a5Tokfu19HEZAstJ5jdqf9gAEv6S0cLPjoABI/pdRaR9bYLw5QhR:YTokfgHqj5dqf9gAyVQdRiN2hR
TLSH
T178D45BC6E75808DCCAA3A2B99972FF01DB367DDC07904BD70260B35A1E779E94D39A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DuiLib.dll

Path C:\Users\Admin\AppData\Local\Temp\DuiLib.dll
Size 2.1MB
SHA256 ebfcff2a17d35f3511dc6ef32491f436247132866706eae701d0f4a81fe73c5c
MD5 b295c1d2e6b3fc8f64b3bdb5c5028827
SHA1 8d68cedbb105989b8dbc839716fd9368c0f6ca3d
SHA512 a8be3cd180e4fee75450506219e4ef306584ee269424455563c1bdec44da3e030a4e23eeb8d91f178757952df044402b211cd778b36742b023b8b24f495d9f50
SSDEEP 24576:VuczgE90D2IZue+aFSLCKjWR51u0CnVarGZlW9gF6FuiOqomlcAYsMiZ1+aJ:3d6jZuLbWR5Q0OV/ZnqLv
TLSH
T184A55B4667AA05B5CC2AD13EDA7B0C27E6F234110762C3CB02E9875B5F277D1853E7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCP140.dll
Size 571KB
SHA256 10ddff48d704c6007e4c2d53fb4856b5e5e79479503366236246a323aaa76e9d
MD5 5cde3aed10412762e83b7fe43694a22b
SHA1 4ffcdf063eafc901105836c27a634530ea614755
SHA512 fcd7bc262e7bbcbbac9258e31b8d62efb2e601ac1fffac4c86819c8f2aed26fc19403d992a57d48ec92752b2a0a8b04e8204423d6077c7800ea4015f016faa23
SSDEEP 12288:yNaAf3QHr+vzkNNpiBfxzL63R+3lD9Bh8888QQEKZm+jWodEEVKB:yN2+d3lPh8888QQEKZm+jWodEEYB
TLSH
T126C40823774901E0E195A3B8A1C78306D7F17C4A8322A3C792F6D66D2F5B7D5A73B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIBase.dll

Path C:\Users\Admin\AppData\Local\Temp\UIBase.dll
Size 2.3MB
SHA256 251a6c74e1641fac7eab4a8a2ee0f652efca40f24c7daa3469844a7286ed5808
MD5 8b37cdd69acedf3668e09bdf8e1b5097
SHA1 f193125148266279f1aa3c7785ff40bc8d33b212
SHA512 2ae9a81a63c450942ffbe1ce0d1375c8569d6a55552d4b5ba9d7dfa5e199b384dfda420a5dbfe25e3f966903aa392ee8fe31f073718208b55c69c6a5e73fb939
SSDEEP 24576:+0Un1+BEU2Pt19VOOFIfgW/9am5clmWrVMoDF43j6glGsRyHIoDDEMHKK8/PiBSk:+0E+BM9VOOFj6c4UMoc3lGsKDn
TLSH
T172B55C037B6F0FA0D9A7C279D93B0946D6A2BC12034393DB0169A74A5FA33D1857F7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\VCRUNTIME140_1.dll
Size 35KB
SHA256 f8bc270449ca6bb6345e88be3632d465c0a7595197c7954357dc5066ed50ae44
MD5 ab03551e4ef279abed2d8c4b25f35bb8
SHA1 09bc7e4e1a8d79ee23c0c9c26b1ea39de12a550e
SHA512 0e7533b8d7e5019ffd1e73937c1627213711725e88c6d7321588f7fffe9e1b4ef5c38311548adbd2c0ee9b407135646593bf1498cbee92275f4e0a22ace78909
SSDEEP 384:diWe6RE3c6lqst5nZvS05fJjPXR51RWmbzw+XfeDky85xHrwB2BWrYKW4dHRN7qp:at3csN7xPXdRdP/ve6HrEUSKZz
TLSH
T13AF24A9463784486E56B81B0C8939F2BFB39F5A1575093CF0B65825D2F63BC0E63E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VkH0.7z

Path C:\Users\Admin\AppData\Local\Temp\VkH0.7z
Size 17KB
SHA256 be766f828ca3a81d2b0b732b4963229e11cf1727b6805f9f48be6cc3afd2ad27
MD5 ff0c83f43f16f3e3290f26656bfcedf6
SHA1 eb1fd73ae42fe6974efd2bdd91af8cf0b5615ec4
SHA512 f91967d1cac4c1a3e17b0b7e5eea9a7989a28b6061cbb97ecaa396f3afe838b3bd2ee204ca3659f49b3baf6815929c762ada548699082eedf62ea7cfc885a8eb
SSDEEP 384:41n1B6f2OB+/4HG+EmM4/yw/DErLFAl/zdHVb/SdHoxPRi:4XBS+/4HtEh+J7EebVb/qHoFRi
TLSH
T1BB82D096DF2340E08BE3ABF10DCDE43656AA7887DE61187840FD13AC02C4EC7E951657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZMDB.dll

Path C:\Users\Admin\AppData\Local\Temp\ZMDB.dll
Size 1.4MB
SHA256 965465e0d9df2c20932c86a143e6a5e79858ad6ff7d7e56dabb35676d544fdac
MD5 7cc88031b127b794f095b2bb9232f724
SHA1 817c799cbe48481eec9f9e91b91b856516cb68a1
SHA512 c80f417972b476773936d83b2157695102876331ef29fa6672182d481eecd76e8d24a54606a55cafdc57cbbd1e95f03f52481863160ff708e8d6dd13e5fb2a6a
SSDEEP 24576:+NvEgpDKUU9hV349wNa8cxVIXV010H/DZvwq11OtrC1hV89ig4xPGf6q:+xEzV349wNaP51U/DZvwq11krUhVkigP
TLSH
T111658D5B73A841B9D5AFD2B8CA475A07E7B1B842136087DF11E08B9A6F537F11A3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZoomTask.dll

Path C:\Users\Admin\AppData\Local\Temp\ZoomTask.dll
Size 796KB
SHA256 f2ca3f8a123c7af7f80d2071c20a484b06d48b5246bf25d22fc3bb6584b81d7e
MD5 01b4991588273b91b2401507e61eb6e1
SHA1 93d4671c5189f90da905f00038f8cbd672d12bbc
SHA512 dd057f35fbc711b7c8b98c4842ffdcd86fabe0362cc0ea53251c88a7e3190020a3eefd527ee861da3d31bb0dba1bdf2216b8599dd9c0b30314157a3760c138f0
SSDEEP 24576:K/ZG9B0XTSU+HDqm41U3A7bVJglupVuTuFuMu6ukutu0uvuhuNuc:K/rjShqHrHVJglupVuTuFuMu6ukutu0o
TLSH
T10F054B5B235C01A9D5AED2BA8A878907F7B278470361DBCB03A0975A1F977E01F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmmbiz.dll

Path C:\Users\Admin\AppData\Local\Temp\cmmbiz.dll
Size 1.1MB
SHA256 dc7e20eb3f0055bbb89e0e3a252d75c847f4cbf9c0f8b6936ec141a07ce1fd80
MD5 42d0ff521395b8ec948e714a71a6ba8b
SHA1 99a57a7f4d3833340a40415cc9ed73d6d139c93a
SHA512 9b81b3e918db0e78fd62ff2ef2e19aed26bf74cc3f44281f1ed2d81e4f99948d00633e93e1e6df53f1c2fc8c7d737dfb3ec94ada5f45cb81876601d24d099519
SSDEEP 12288:yVDHhB/1ewpY247M+NqfmvrhUvWBXZGqMC7biwYxEf5qTJF:yFhB/1ewp2MzfmvrhUeMMbiwYxcK
TLSH
T1DD351A1B67A401BCD86AE17ACB9A5B43D5F27C064BA997F70B5085064F933B07E3B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll
Size 4.3MB
SHA256 d1b50f7075e2ee47c8d184e38862a83b880a90fd2ff00da7bb1eb61e24e00f5d
MD5 88262b51e7ccdb3d81d88c7712849b2c
SHA1 007327678559f4113be8c48bbd0574a170617c3d
SHA512 3398277f97aae9e791485d3950b9ae012f5386ed3023d5db2856c57ccd8209ace795cee3f5ac9c48760f6a85f953aa6c02a3cb0bd70388b8038a77dca1f422d4
SSDEEP 49152:ZTMG5Z2OLpwf24Q6QnCF29Yhlua+V16Ar2EclBTz9pjUj8PJKhuQw6sRAy3Gk6d0:a5+nQWao6ycl9rGzd5sz
TLSH
T12B266C47B7A400E9C2ABC13886479717EBB1781403345BEF55A0C665EF73BE26A3B724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc9c7950-8aec-4ba3-afd8-a956144d85d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\fc9c7950-8aec-4ba3-afd8-a956144d85d7.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-zm.dll

Path C:\Users\Admin\AppData\Local\Temp\libcrypto-3-zm.dll
Size 5.6MB
SHA256 b286eb3dcf22b6df034e7878ae099cd428bb896d07302d63aaebe16d38e721a5
MD5 43f92e150073a789c7d78c81f66938c7
SHA1 9a024e2e2fc9ff5ae5a2a7c6e467a0c52d9710c3
SHA512 4b480b27f71638922a1ec8c7f0f69c96985ef0a25181b3394bd5b2c89bcac1bd4bdd6030ecd1cf250363da3ec9d337fe15bb96afed6c6c7f8a495482f7351635
SSDEEP 98304:mM+DKVXeE2xqVrqnDPk+F1CPwDvt3uF0nCKj:mMUKVuE2xqVrqDsu1CPwDvt3uF0nCU
TLSH
T1C5466B2AE7A81189E4BAC13CC6534723D6B1F826577097CF15A196B90F33BD92B3D780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl.dll
Size 901KB
SHA256 8a9afce7ec989c95f9867ba4f08c30e0c38bf06cddea9f9414cc13d3c10afea0
MD5 58855c9a2859fd0f60fef08391ea5c13
SHA1 cf13130bfd022e261be0d662f0833caa002190bb
SHA512 81021583e4a3a1e715a4d6360c0529f349b95decb31a111ac4d44ed0fc8f80132e292648c9379cd801eda37359f38b106b0cad336e487fb01628e337a6152d89
SSDEEP 12288:ePShAS06YnDBCYYVSq4VTXyeDW2WdFhtQ2:ePShq6MDA3VSq4p7DW/dh
TLSH
T108155B8A73A415A9D577C13CC683871BD6F2B442176093CF13A08BAA7F23BE6573A354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-zm.dll

Path C:\Users\Admin\AppData\Local\Temp\libssl-3-zm.dll
Size 1.3MB
SHA256 92914d1426721811fb388a3be864dce01a703b40d994926adbb53d1131c2c35f
MD5 dd6bb11b818d064cc3c2bddf96be409b
SHA1 414e918cbb55a33682cc4619445d0e7be0681862
SHA512 4373394679f4c11658295025f24bf96d54b9904b16e2f491fdaba8b8ebf357e6f4830cb7f8c182626d69d5301f555aa9d701d7692e222cf2dec97d4c91b76019
SSDEEP 12288:IPA9ahzye+iXrzAEXEASSkFwgizj9PhqpJAh1zz77S:H9ahc4d0+kFwPnIJAh1zjS
TLSH
T13F556B5AE7B8115CE9B6C13C86574B17D2B2F4062370A7EF066186B90F23BD9273E784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msaalib.dll

Path C:\Users\Admin\AppData\Local\Temp\msaalib.dll
Size 52KB
SHA256 e91adffcc7aa1081eaf6d64658e5a17a8ecbab7c5a3fed21b0f2f870a795efa8
MD5 83b9c36906f9fa81b6af6cf9f93b0990
SHA1 6b34e7dfe5ddcb8ca53d862de0c9265971cc08c7
SHA512 5b14b38ed32845e25998852ca980176ccc6e549183377eef58c57968121b36d8ec4af8898d5fd00faefee279395252dc01cf55f7806b69daa16eb351bd3521de
SSDEEP 768:MmMRiZmkJQ0Wq5olXfXdaGTwozrLcl3Yy0S15ALZYy0Evu5ALl0:M4AfXdaGT3rLcl3WpWEX0
TLSH
T1AC338D5A97988851E8174971E4D34E3ADAB1F4920B61C3CF1318C25E4FA3BC27BBD35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 622KB
SHA256 08f2fe38501a88a7d3c13976733c2ca08b5597c3328d51fa1f5f5d8474c33ecf
MD5 26e256e40cdb3b9cfe599653c8708cb0
SHA1 384b28625cf8d2e0d3ba8d0df93b1f8d94f281e1
SHA512 4646b1c9633fc03e5ab6cb90c977cc3d778e73d8ade58d019c22ca11a3367b8faa3a18a4e2f4738a75df80a5a788f956a2a0c33dfd6b48272674d03899a9f5d2
SSDEEP 12288:SuByC4QcAuILYRHeJSnQEKZm+jWodEEVLJSifhIl:mCzuhCyQEKZm+jWodEEJJSiWl
TLSH
T19FD41816BB1949B0D162A3B8A5C34702E3F2BC064771A3C742EBE16D1F677C56B3B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pipeline.pdb

Path C:\Users\Admin\AppData\Local\Temp\pipeline.pdb
Size 277KB
SHA256 b67a12c16b81b722bef5d32da3b36542f61b8efb58a61f5830877f0951c896f9
MD5 a2f15072c062260a371605dd19067dcd
SHA1 68292823ad6a5848251950e5d4ddc532a12fe811
SHA512 5f9b9ccfcfc5b41897e577fb686d7422fb3f242794eb8a243a164fa1284b6bfba8460d624005d4a3271416b6f59b0309e0edf4e46c3e716f4830758b6faa8a61
SSDEEP 6144:QUt+mehcUYU+Zboycyaj6tjegbQiU5AHrCgN7dQfd6:J8eaycnjH10cw
TLSH
T1EE54E325E1E1D518E6B6B7FDB53B4011E12366CB3A2B8B8523BA32DD493FC44CD90A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reslib.dll

Path C:\Users\Admin\AppData\Local\Temp\reslib.dll
Size 55KB
SHA256 83af556821c2ea951425b307db288ec53fb32913757d8086d265da0cdcd59cb7
MD5 796308ae73137a62e24f3809342e031a
SHA1 36793f611a57bf41b75436455787399dc416d614
SHA512 8738703b6953b890038ff157868a2882486fb4baef836edd8b270ab113b7e84ad574fd62e38453c9e4156ef5a944434023dac57337260c793ab387bf2312a85d
SSDEEP 768:Pn9k+Nep1iOJH3q4jvWnjNZzYLE7pEzC+51wzv4AchgudYy09l5ALWYy0E5ALVK:Pn2z8OJH3q4a5ZzYYE75m6hgudWtWg
TLSH
T1CB439D67AB880845F927DA31F4D2592ADAB3B4925B51C2DF1314C12B0FA23C17FAC766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5436_1659533645\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

textureext32.dll

Path C:\Users\Admin\AppData\Local\Temp\textureext32.dll
Size 6.5MB
SHA256 654e9f5d24974edbb254f9037766cb997e3f0b22a4dc67beefe8cb5990fe0bf1
MD5 9410ffb4fb6154f425aa60d5635cf0ca
SHA1 6f6be90a65e245875f2df0d76169b5de9e54f9ba
SHA512 063fb064843ec26cf776d208e09cf31dfb473849df0e117ec001f8fc016d863b9f858a9c779278abb4fdb85910c2e71ec4180f001eb32f5a92cf9123640ae730
SSDEEP 196608:shzV9i6gA+RXjJ7qYceLGY3BhTDAbTyM9ejqwzFRjW3G/uNQe5JXpd:5q6zQDE5BhT0TyMVNfr
TLSH
T1606623ACEAEC2731D5F22DF7B65ABADE818E295517FC24992FF1C190530F182447A243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tp.dll

Path C:\Users\Admin\AppData\Local\Temp\tp.dll
Size 1.7MB
SHA256 065ca011f8246e716d18ddf82dc68ad8aa220c49ccc29d6a8b8fa080671405e7
MD5 a0aaa9b2fc03203c3f60587dbd3cc779
SHA1 67419c2e5528b909d4cc4d3c8cfdbac2c2f5d005
SHA512 fac7b083aafb491e0da04c553e4f53a9f1149b974e889728d9baa0144a901ff0c3f1427a0d34ed4b673f6fbd05484e701625d09af42501e470451efde528014f
SSDEEP 49152:qggXcENM2+8S8KAmWlNXOhmzWsNLKT9h+xSzx:ZzLh+xSzx
TLSH
T1DC856C4723488069D5ABD2BCDB4B994BF23570411B72A6DF03E1891A2F8B3F15FB9760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 d93ce42cd625510b2355de086bcd19e2c11307ccade7bad62b09c7f340a866ba
MD5 24ebedc58aa4ff23043bf79b05d267d4
SHA1 c2e7bd18e4091f2a7f7c933a5734b05dd971f24c
SHA512 7f0563e814cc4aaf292683403888340bb5d95e6a7bdd35d81eebbd10bfb8e4e5130d0a626b8fb07ff3cafaae4a2698cf7103aabcae74e5d13449db482ec49bc9
SSDEEP 24576:2RmADWOBBIHv0XESwR5H7iFZBmai0gFcszUmxvSZX0ypm7:WtI045H+ZB7fgDz7
TLSH
T1C835AE28B76C02AAC57BE17DC923550EF972380447709ACB03A74BB93E277E956B7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

util.dll

Path C:\Users\Admin\AppData\Local\Temp\util.dll
Size 466KB
SHA256 2b122736be8059213719dae2bae972b81c5f56e717f6d3d13b4e49313c280789
MD5 1ec58404414d88f24c65661022e9d210
SHA1 34da690fe8192c58fe0ba0744bc4a8dfe80a9c7e
SHA512 bd95de2eda6dc91a0334648b6b91c5c421d3087cb62e4a99b48538ebdce55e64ea32abb46bdf9d1ee7f614e097bdf51cf3634f4c6f786204a0be40b2d7091f39
SSDEEP 6144:RNC2yfSV1W8JriBsDrxwo7rIW7HY6QuyjBSSyHuJvd8shdE6/3ta5zWo/y:+2/6qrXDrxw4RyEfuvPslWo/
TLSH
T14DA43C5FA34F0066DA62D2788987A406E3B374414B4297CB17B5CB6A3F533F4677B2A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
Size 91KB
SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
MD5 7942be5474a095f673582997ae3054f1
SHA1 e982f6ebc74d31153ba9738741a7eec03a9fa5e8
SHA512 49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039
SSDEEP 1536:bS6NH9M7vShoxXqYGZLAy10i5XNS83NT/sM9MYDiRecbbVKKoB98:bFRmxXqX0yvX7mHYWRecbb8l
TLSH
T1E7936C4AB2A452BBD16AC174C4F35A06E771B844873053CF03B54AAA4F6BFE15E3E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zContext.dll

Path C:\Users\Admin\AppData\Local\Temp\zContext.dll
Size 51KB
SHA256 2e138cbc90e3fabd1de4189cdb12775d860f023781d4be383bc389caba7c9272
MD5 da5f527513b9b40b6bedfd7686f5c899
SHA1 a86347ff4aa446bfb6272a9a77b4d216d49a25c2
SHA512 517448f6ce4db4fdb996f59fd301cc42dbc896d89488643986146400b2f17c51dd29c9ed38c07ab7d6713f328ef905bf6c450c14440dd66c943b0a361bf5fc72
SSDEEP 768:2JzJEbmALNz6+jx6bqHK3R5qtaYy0w5ALfYy0l5ALFZ:WOb1pjx6Wq3fqtaWjWWZ
TLSH
T194338EC7556C4886EC179A35F8D25926E633B5924B21D2C72314C26B0F937C23BBE2E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zCrashReport64.dll

Path C:\Users\Admin\AppData\Local\Temp\zCrashReport64.dll
Size 397KB
SHA256 1c00992009703d6be2191cecdebcf368aa4dd8da892428040db2121f61097fb9
MD5 2a2da6891b7219790974babc3aec6f3d
SHA1 8c9a344d642ff3ecfef2c39a778d38e6509f75e8
SHA512 d1a473879dd54b5935cf7f66b85f96fb4f77246386af178c9d89e6a0460585fad2b657d14aa6d294db478bc4bba15b6817dd0b0d2be58b75245f601aa8b30e6d
SSDEEP 6144:VezZrP01iukLQW0N3U3+SeHeK5FeBpk09Q38cD/:szZPduqtBOSe1spk096D/
TLSH
T103846C15E7A80875E1B79138C9B38D0AE7B1BC5A07A097CF23A4465A1F33FD14A3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zLooper.dll

Path C:\Users\Admin\AppData\Local\Temp\zLooper.dll
Size 97KB
SHA256 afcbadfa2704cd1e1cdf886ca60e4f573b9b15914daf7d3e8acd3e5854a435e4
MD5 7b1b828c80c66994191f2ec81c425555
SHA1 48ef324dd5bc379fd8e610d0990bd7b17ff314ae
SHA512 77934cd67a803f4f3c665f90c99bfd52ae2372bca8e865775b971ba000e57809949695f7da884edda3fb23a1b92ee87f069eb2c19d1b76ca0479a98fdd9368f9
SSDEEP 3072:0PgRgY68eeiAM2BlMCXEK/kU5E0XVfWpWj9:0PkQ81nUK/kU5E0X5gC
TLSH
T12BA35AAFB7980484D8B6D178E0C69A09F772B84143A297CF5261C35E4FB77C13EB9681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zNetUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\zNetUtils.dll
Size 268KB
SHA256 594161cbda00a7c6deda15f7b1fd4aaba83b184956cdd885bea2bf842225cd90
MD5 3361f441f9b5913c9125b3804f5e0034
SHA1 b719c160238a2b5fb5a0d9130a4c91257c6ee723
SHA512 7d380b22ca71199641394fe91de6f6b622a499fffe5565742b513f9dafc2496977b13406797d867bec2423c966c91d2741cff43773d54cbc01cbeeed36f036d6
SSDEEP 6144:UaSn5PN4zq2P5LB0ucTtbB1s89BCHvJ7KSTjNob:UB5PN4G2P5LBDcL9AZKq5G
TLSH
T1A7448D5B76581EB2EDA3D079D9C7890AE2B3B4410355CBEB0361CA6A0F637D1BB39350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zWinRes.dll

Path C:\Users\Admin\AppData\Local\Temp\zWinRes.dll
Size 12.5MB
SHA256 3e6d1a46cb36b7d107313b3c5a13593ee2fa1f9b44f13395d700b2f648b24614
MD5 9752ded779115997c74eb2c79b19d5db
SHA1 3ec566740522c2a3cdec2d25a247dd04bef8337a
SHA512 241c6618e80878ffecfc2b185026e7dddbcc7e180594a8e19c39873ef58abdf25a1c3d6c10578acebfc459906eaa45cd2e590ca9f5dca91025b65ebdd4806ea4
SSDEEP 49152:bHeEbcyRAQCAQSGgn1Fh3Do2+sl+cSNsdCVRdLhhTJZ3WtXBwGNRBvBxwscyu:bFbc8z3Dj+dOChbTJmRxfxwsc5
TLSH
T129D66C60D3F81D68D2B72731EB369990862AB8E7EB78C2CCB11D312F67B24418C56775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zoom_meeting_bridge.dll

Path C:\Users\Admin\AppData\Local\Temp\zoom_meeting_bridge.dll
Size 2.2MB
SHA256 a66414b3f6d6733a8e7515322eb053ae91a9314d1c82f8baf9b7db3ad6d8c943
MD5 a929b2e9cbf1d489616471bc93e0ce4e
SHA1 b6a154220e55ee2a46865d6b0c57b4aaf6b7a72d
SHA512 153fd7b6b1a4e7451bc28301dbdc6c161a97826b3cbf3d686e766723d365b46e82e5f6aa83e55d7be043eaedd4ed2f44553f0189f286a95a3d795c89476f461a
SSDEEP 49152:1wMUhKZnxTesZ3pT0H5T6qczDBueHG5M++nV+Va:9v+Va
TLSH
T103B5282BA77986A4C59AD1BDCB8B4F0AD371B016472187FF42518E6D0F373E20E76A14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1488-117-0x00000256728C0000-0x00000256728D2000-memory.dmp

Download

memory/1488-112-0x00007FFEA6180000-0x00007FFEA63CA000-memory.dmp

Download

memory/1488-123-0x00007FFEAEAB1000-0x00007FFEAEAEE000-memory.dmp

Download

memory/1488-114-0x00007FFEAEAB1000-0x00007FFEAEAEE000-memory.dmp

Download

memory/1488-115-0x0000025672880000-0x000002567288A000-memory.dmp

Download

memory/1488-118-0x00007FFEC8950000-0x00007FFEC8951000-memory.dmp

Download

memory/1844-149-0x0000000000C00000-0x0000000000FBD000-memory.dmp

Download

memory/1844-139-0x0000000000C00000-0x0000000000FBD000-memory.dmp

Download

memory/1844-140-0x0000000000C00000-0x0000000000FBD000-memory.dmp

Download

memory/1844-143-0x00007FFEC8960000-0x00007FFEC8BC3000-memory.dmp

Download

memory/1844-183-0x0000000000C00000-0x0000000000FBD000-memory.dmp

Download

memory/1844-148-0x0000000000C00000-0x0000000000FBD000-memory.dmp

Download

memory/1844-150-0x0000000000C00000-0x0000000000FBD000-memory.dmp

Download

memory/4256-134-0x000001DB1D920000-0x000001DB1D932000-memory.dmp

Download

memory/4256-145-0x00007FF618BA0000-0x00007FF618C39000-memory.dmp

Download

memory/4256-132-0x00007FFEA5F30000-0x00007FFEA617A000-memory.dmp

Download

memory/4256-133-0x000001DB1C0F0000-0x000001DB1C0FA000-memory.dmp

Download