hijackloader | 1a9c85046db6983f741c7706861c4080762ec7059df38f0522ace6f7e36cac55

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/11/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-08_e480f56f6d0ecd94ff16a81a298d23b9_coinminer_elex_wannacry.exe
Size 6.1MB
Sample261108-wf7zdssxcs
SHA256 1a9c85046db6983f741c7706861c4080762ec7059df38f0522ace6f7e36cac55
MD5 e480f56f6d0ecd94ff16a81a298d23b9
SHA1 35cb82aff784b6ff5748639334bd09efddf6f0ca
SHA512 e1e1d95a867909cae138fac5d3fad846698199bd9399bda40048dc216b716a6843f347047bf80bac6f4b568d1215f732117a3d467ae8ac135ca15da6b8a19e50
SSDEEP 98304:+prCsCPGyLPsSt+BADC78i7tNifeHdDWp+CKjkW5Bbs1GiDzzGk/:+prc+ultvDkriW9mVK95iYczzGk/
TLSH
T186563347B390ACF2EE79D9B18F0BDB2A8937DB5706505F51539A8C121DA30A3470F8DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery hijackloader loader privilege_escalation spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\maintainhost
inject_dll
%windir%\SysWOW64\ieframe.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c558-32.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
1876	En_Bu.exe
5292	En_Bu.exe

Loads dropped DLL 9 IoCs

pid	Process
1876	En_Bu.exe
1876	En_Bu.exe
1876	En_Bu.exe
1876	En_Bu.exe
1876	En_Bu.exe
5292	En_Bu.exe
5292	En_Bu.exe
5292	En_Bu.exe
2244	ZoForge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 5292 set thread context of 2244	5292	En_Bu.exe	91
PID 2244 set thread context of 2144	2244	ZoForge.exe	97
PID 2244 set thread context of 3304	2244	ZoForge.exe	125
PID 2244 set thread context of 2144	2244	ZoForge.exe	97
PID 2244 set thread context of 6048	2244	ZoForge.exe	132

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	ZoForge.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	ZoForge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	ZoForge.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\NOTICE.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt	ZoForge.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	ZoForge.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	ZoForge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	ZoForge.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	ZoForge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	ZoForge.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt	ZoForge.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	ZoForge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	ZoForge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\CacheApi_v3_0_win32.job	En_Bu.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ZoForge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ZoForge.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-08_e480f56f6d0ecd94ff16a81a298d23b9_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	En_Bu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	En_Bu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZoForge.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2552	chrome.exe
4492	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2244	ZoForge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5292	En_Bu.exe
5292	En_Bu.exe
5292	En_Bu.exe
5292	En_Bu.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2144	chrome.exe
2144	chrome.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2244	ZoForge.exe

Suspicious behavior: MapViewOfSection 1 TTPs 5 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
5292	En_Bu.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe
2244	ZoForge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeDebugPrivilege	2244	ZoForge.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1876	3000	2026-11-08_e480f56f6d0ecd94ff16a81a298d23b9_coinminer_elex_wannacry.exe	89
PID 1876 wrote to memory of 5292	1876	En_Bu.exe	90
PID 5292 wrote to memory of 2244	5292	En_Bu.exe	91
PID 5292 wrote to memory of 2244	5292	En_Bu.exe	91
PID 2144 wrote to memory of 1440	2144	chrome.exe	98
PID 2144 wrote to memory of 2552	2144	chrome.exe	99
PID 2144 wrote to memory of 2572	2144	chrome.exe	100
PID 2144 wrote to memory of 2572	2144	chrome.exe	100
PID 2144 wrote to memory of 4296	2144	chrome.exe	101
PID 2144 wrote to memory of 4296	2144	chrome.exe	101
PID 2144 wrote to memory of 3952	2144	chrome.exe	103
PID 2144 wrote to memory of 3952	2144	chrome.exe	103
PID 2144 wrote to memory of 2936	2144	chrome.exe	104
PID 2144 wrote to memory of 2936	2144	chrome.exe	104
PID 2144 wrote to memory of 5524	2144	chrome.exe	105
PID 2144 wrote to memory of 5524	2144	chrome.exe	105
PID 2144 wrote to memory of 5020	2144	chrome.exe	106
PID 2144 wrote to memory of 5020	2144	chrome.exe	106
PID 2144 wrote to memory of 4192	2144	chrome.exe	107
PID 2144 wrote to memory of 1388	2144	chrome.exe	109
PID 2144 wrote to memory of 1388	2144	chrome.exe	109
PID 2144 wrote to memory of 1248	2144	chrome.exe	110
PID 2144 wrote to memory of 1248	2144	chrome.exe	110
PID 2144 wrote to memory of 1424	2144	chrome.exe	115
PID 2144 wrote to memory of 4660	2144	chrome.exe	114
PID 2144 wrote to memory of 1424	2144	chrome.exe	115
PID 2144 wrote to memory of 616	2144	chrome.exe	116
PID 2144 wrote to memory of 4660	2144	chrome.exe	114
PID 2144 wrote to memory of 616	2144	chrome.exe	116
PID 2144 wrote to memory of 6036	2144	chrome.exe	118
PID 2144 wrote to memory of 5388	2144	chrome.exe	117
PID 2144 wrote to memory of 6036	2144	chrome.exe	118
PID 2144 wrote to memory of 5388	2144	chrome.exe	117
PID 2144 wrote to memory of 4384	2144	chrome.exe	119
PID 2144 wrote to memory of 4384	2144	chrome.exe	119
PID 2144 wrote to memory of 2476	2144	chrome.exe	120
PID 2144 wrote to memory of 2448	2144	chrome.exe	121
PID 2144 wrote to memory of 2448	2144	chrome.exe	121
PID 2144 wrote to memory of 2508	2144	chrome.exe	122
PID 2144 wrote to memory of 2476	2144	chrome.exe	120
PID 2144 wrote to memory of 2508	2144	chrome.exe	122
PID 2144 wrote to memory of 4280	2144	chrome.exe	124
PID 2144 wrote to memory of 628	2144	chrome.exe	123
PID 2144 wrote to memory of 4280	2144	chrome.exe	124
PID 2144 wrote to memory of 628	2144	chrome.exe	123
PID 2244 wrote to memory of 3304	2244	ZoForge.exe	125
PID 2144 wrote to memory of 672	2144	chrome.exe	129
PID 2144 wrote to memory of 1248	2144	chrome.exe	130
PID 2144 wrote to memory of 4680	2144	chrome.exe	131
PID 2244 wrote to memory of 6048	2244	ZoForge.exe	132
PID 2144 wrote to memory of 4492	2144	chrome.exe	135

C:\Users\Admin\AppData\Local\Temp\2026-11-08_e480f56f6d0ecd94ff16a81a298d23b9_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-08_e480f56f6d0ecd94ff16a81a298d23b9_coinminer_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\En_Bu.exe
  "C:\Users\Admin\AppData\Local\Temp\En_Bu.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\ProgramData\maintainhost\En_Bu.exe
    C:\ProgramData\maintainhost\En_Bu.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:5292
  - - C:\Users\Admin\AppData\Local\ZoForge.exe
      "C:\Users\Admin\AppData\Local\ZoForge.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3304
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:6048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:1992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa673dc728,0x7ffa673dc734,0x7ffa673dc740
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,9392904510892866050,12136398315491187356,524288 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,7277664805649405059,10301636053453033703,262144 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,13625935855712840439,2301134290085966872,524288 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:13
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,17666138662033278481,14171328216574325888,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,14315782156192372553,7906324270960783368,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,50023514856874517,5792522585804469134,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,16788631470848920878,11425803969402742034,524288 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,14349130598304583260,1209081671284110031,524288 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,12536754146779085429,15401261464129719074,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5448,i,15330706702552564316,16172434974499884734,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5556,i,10820625760851942793,9372326919489190657,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,12209555882542970541,8648889122029032629,524288 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6220,i,13335001763649164042,2176510256385017518,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6664,i,10294268439515154925,14387077281000067648,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6668,i,1503675243648333988,5032214615317267299,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,7941108042456692035,2878479514075418215,524288 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6568,i,14746070276923469032,13709364606320539575,524288 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6024,i,10842338118570730485,13229870798095623865,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5572,i,12440081682381652254,2229564920986928156,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5676,i,5083296917343586802,2865111660116012792,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6024,i,6115441003179276052,1341786787887935917,2097152 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:9
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,3562457747616764376,2520933579560823551,524288 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6208,i,11746607314610357441,4521821494456355642,524288 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,3760068149060934152,2783193668578114575,524288 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,3235336786461804042,2310960457429732494,524288 --field-trial-handle=2424,i,14638272082393570749,5415493445536461445,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

68a4c3d13bdaff306c2c96601db89dc487a5bfae

Path C:\ProgramData\Jovise\Cusak\68a4c3d13bdaff306c2c96601db89dc487a5bfae
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

3fd56daf-4ca7-420a-8f67-0f94d30feb7a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3fd56daf-4ca7-420a-8f67-0f94d30feb7a.tmp
Size 148KB
SHA256 8eb042e9325e1f67fb1b971fce0b1d2a49f7fb86c21cb83876ecee1f94c08be2
MD5 dd5df0061ae0e438f8951f2850fcfef0
SHA1 9b07fb4c55820b4120a79439bea2fe02ab90ef4a
SHA512 256fe337f6548662343f2725a29d65e3e408d2d68eb07c99cc1e75f5eb378f8ade5ed15f8b42277607a5db39c7164f666c64cfcd9cc06e34ddcb4385f4906d30
SSDEEP 3072:FqYzR052CzeQict6eC1QSMawIDK0Vnu9QssX12laDtmthgv4hUFql:FtNw06XCaOwIJVnuSswAl4jw
TLSH
T1AFE31270FD0CEC69D3FDE85BE10A1337C870AEAEA3045C8976D25509F5C6A690E62C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47430b47-84ce-4eea-afb9-b3f26d0a34ae.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\47430b47-84ce-4eea-afb9-b3f26d0a34ae.tmp
Size 148KB
SHA256 06104a4f35fcd5afd157c5f160c1ed9adcd2a52e8157d6f48cb6031e54e811da
MD5 16c3b8929fca7aa5d688e99a95e05c2c
SHA1 2138bf96796be5f3f54cad32234fc50c1a94d71f
SHA512 9c642cb34fff533cb0d45b853c2b4fbc88ab321debd2d9afe34f118c6d17f9dcb0a216b33a8d2a79b83a83ed5faf282361f23f2329e1db7a7388357af36b2710
SSDEEP 3072:UqYzR052CzeQict6eC1QSMawIDK0Vnu9QssX12laDtmthgv4hUFql:UtNw06XCaOwIJVnuSswAl4jw
TLSH
T10FE31270FD0CEC69D3FDE85BE10A1337C870AEAEA3085C8976D25509F5C6A690D62C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Breadcrumbs

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Breadcrumbs
Size 603B
SHA256 498fc47c7cf98656e1c42e6129dd26b22942a9f45e58e94a19764f5663bfa7ed
MD5 e33539813e79c9cb230ec05685ec4bf6
SHA1 fde3375da535f05330c01562fb063a3b7a65dabd
SHA512 cfedcc333f97884a53ccc3ef0862ca255f39bbe29a89f68c11b44d3db35bbe8c267f4bebbb6d2225b3d31de8ed083ddf3c5459a05dda7dd5093a361fd5533dfd
TLSH
T136F081E623B25E09D252B772648B7FDFB443E56542C8E6FCB5C03B25D519861C256203
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

170c048f-b4d6-4348-9678-32ec705c492a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\170c048f-b4d6-4348-9678-32ec705c492a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2d5a33f8-0be9-4524-a420-b97fcfc93bb7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2d5a33f8-0be9-4524-a420-b97fcfc93bb7.tmp
Size 12KB
SHA256 679a92108592f78dda681e2134095f4ef4bde7dce0d6b213ffe6c0819ce5fd7d
MD5 1a9160fd376b543aae554f2ab5644595
SHA1 5fe996b7cf995a30bc172280d64f838566375efb
SHA512 441ea30c6542250e885567d10c647dab0f4090fb5d5b76d992540a7e6a8467990ad397ba76b0939be477a646d101a2b1d4d82dac0b528ce8fee279b18d9c156e
SSDEEP 192:W8RKvACIv7sPPRprjP9bHsb+WNnVhRs00xT2vVMekwwC6+VyIsnAUgE:W8RKvpUIXHBwV7s00F2vV+jC62E
TLSH
T13B429529EE14793BACD6C329F9617B97D6F5102261D02E84E6FC892C25EB6CC7227107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3453a8d3-6bbe-4720-b9cc-93d4541dae70.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3453a8d3-6bbe-4720-b9cc-93d4541dae70.tmp
Size 11KB
SHA256 55007a02da8b534c557d047fb4c5cb9f068f0fadb1f8d2e23849dce9c75bed00
MD5 d16c1d3ef189d22bb33d109fc5553f2f
SHA1 30a4f3dfe6c9acca1e39d17ac45c93dcc469cce6
SHA512 62e165f1df3d36ff5a32d5996431c5820666178eca0e7e786bda8968d0aae057e934f3244d92457f8535d9022b6558536e6de05c57796ca4e977fd713922334f
SSDEEP 192:W8RKvACIv7sAPRp2P9bHsb+WNnVhRs005T2vVMekw+C6+VyIsnAUgR:W8RKvpUJX4BwV7s00d2vV+DC62R
TLSH
T144329529EE14793BACD6C329E9617797E6F5102221D02DC4E6FC893C25E7ACC7227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f328bc1-3860-486d-87de-e0baac567f12.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3f328bc1-3860-486d-87de-e0baac567f12.tmp
Size 11KB
SHA256 e1532c2a556f8e282691c6af1c8f3ff3dba65cc196086967da0d71108f861d3f
MD5 ab0445731d843e06dcf056b422dad1be
SHA1 600e6848f825f780368b7336e50967b54d910073
SHA512 d028d73f78452d5019797835f8ccb51c166d5e5a349078ed34463d4e12faa73101f31e2afb0a8a69de17d0fc24710f5075925a23ff7caee4c9ab04a1c19f7c9c
SSDEEP 192:egn4K6m87KxkXqK4I40pUZNCgVLHrKHfFKslEiYeXzKD/Zk+ErUkKN9TWvSNmMsE:FnjB87KxkXqKf/pUZNCgVLH2HfgslYeQ
TLSH
T1B432C927948DAE3F4FD8D91DCC166F8FADB5025672780D2496FB9C0403A97CA214A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0dc94d853cc4b1b7cbb6e033c1db4886a6c0f411301ff8783b344a1e9e1158f4
MD5 7a3bbdd38264022c9fd2a08613cb8e51
SHA1 2114e286ebc2b40aa1872885f7bd729671aa55c9
SHA512 f8fe72fce6c24a5bad6891aec95f0d19e06ff3f727d839aa42b2f023c92c3c3e3d5f118eb925069d1a2485fa59ae5ddf052f8b499cee6da173faa89b65cd9e65
TLSH
T174E02BBAD821DC375CFC0B786048078AEA6023162640A44B773C920CCFB573A4991C9C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 44KB
SHA256 4b8bd080b24fa9fb4004363bc2f5f45c9fa96b8ee0556c79bc9f9a93b05903de
MD5 cdc9bbfdd8ebb1b5778ff33897601e63
SHA1 14c19a3f31e65fa196b67aea486527120f1803e2
SHA512 e8f2fb48af291d936ac693edf2d5f693594a8f3b6ca266313e5c4ecbc58f14cbf2148830d200da4d0d844a6be0c8583071c05ccd4d628a0afa8d45abfdf441e6
SSDEEP 48:C8JqQq3qhmr/O43b/Y8uaLNW9WjWbfl4pwUsxWMr:ZCEmrm43b/LuaLNW9WjWbflnxH
TLSH
T1FE132406CF342C61F1CA873688818AE70F3E17DD526B5D65557804639F82B8481BF1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log
Size 95B
SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
MD5 021b8d293c14358bb37b18ba45792aa5
SHA1 22e73b3a1d152734191bf7de9472a54be346b706
SHA512 ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG
Size 320B
SHA256 4df44012430e3a7cfac3e19e479490bf0967d186d2b8c1a403b83d2b4b7f148a
MD5 950d3678c5a6e6cfd83eabfb26a7d13c
SHA1 187b9d48326dd641725cd3872cd7dd83d22f143e
SHA512 77dbff25daa196631e97526ab895871c76986346394598655af24d132b45af791da38547020d5c59842cbaa2c1d10d66fd9b2a511286bd3a954abc06e47cae40
TLSH
T12DE086656489C57D555DD857C2EAF70CC6D07828EBC8351B974EC448318390875D9674
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG
Size 324B
SHA256 ca487ed550ed1646307f9438468ff833b2c38053981d183ffe0cb0a25f05c155
MD5 d806d9229800500df40f259de2a59c05
SHA1 1b019334a511cf45de860aff0fef5d22b696a7b3
SHA512 718d86ee33303239f0817ad99c40491b5092919d96a35ca6cafdcc8cee6702b480ccbe28fd90417000007b85e718d92859fce85bff6275eb430153bd5240549c
TLSH
T111E0869C6889C52D5A5DC85783FBF30CC7D07424ABC8BC1B974ACC443187A0465D5A70
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 4636c0402c3ab1d238544575f5c259d336a8a116ddb5fa3ef4fdadd2f5bc5acd
MD5 044081ef825b83b50d45894947d80cb2
SHA1 07c60346114ae61048e965687577f0ce41cc5720
SHA512 88aebcc664b8268a8d3c58ca6a79ac35545b1b5d219d9eefd7bcb55996cd67dd5f726a5015f80a5f04ec139340ec5f8fa9d7f690ef22d27f22f8c78721def4c6
TLSH
T175E08644A489C92D559EC86B82F8730C8AE13404ABC5382A1749D4443582949AABA6A4
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

21465e1e-0ef0-4d2d-9958-f3d0899474b0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\21465e1e-0ef0-4d2d-9958-f3d0899474b0.tmp
Size 2KB
SHA256 bbef35d53198005b02d32104abb6cfa46451ca39253d266f74407add11af819b
MD5 b8d3880ab476db16d6d66f2da01f3af2
SHA1 81529fb112db11b538b4b6aa6d1f8d95029841da
SHA512 95f91105c2cceaf5975fe344b0be28bb5d2b0bc9248e07c04a5a4e924e1004c5e2d2454a3a2e462c7bc273fde92b29675a83910ae01c9d00a3e74b64c05c383c
TLSH
T1A9516BF7D7D4997D851556E49B216E1FCE2E0A28121C3C668CD8AF4B53F2872E21138E
MD5 SHA1 SHA512 TLSH

Submit Download

f9aee568-81a5-4ae6-87fd-de263acc27af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f9aee568-81a5-4ae6-87fd-de263acc27af.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 3295c9835b0a643512a94807bbb5ebc17bc935e18a4ead50205c6bfa97344d60
MD5 aa1101fe513e2ad3356b26da4dcb3235
SHA1 922ebcb89fc5b70038a4a7a081561ec302e0c42d
SHA512 f9730d7b63a7b5051fe87606bfdc4b964db5fff8c0f57ec81be5f3e5f26a3998a3c06f5b174da259e15d8783779e6a55870c0d7d63691fd92557a52b889fa067
TLSH
T1DDA0021443CA4421CE4142B1E5610A516353883865B9470F759345898E5BDD65311540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 86aa6da7bd8c12676697afb9397e51850f1c7c658757097d05dda11f33c5f958
MD5 f3a5064a311e3cd99f5f68331ba32536
SHA1 a5f56e42837e374c3aaa1ea17904580692c87e4f
SHA512 ca11499beabb15bdb5cf70a08cf192d96fec525ca016dcb0cefd5566c7ff49f087bb4afbf976b433c15f5c1b6c154060219cef1e6cebab1fd1276917815c99fe
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 148KB
SHA256 49a98ef2049f7e4f60abf156030c2eba6ac35acb8bc6862337a4b52dbd6be78d
MD5 c55e7f1151a0a4ed2258ddc9e01be01a
SHA1 f1012df8cfb18a6a80c90a95d3d57da11c5a4652
SHA512 66a219567e77a33fb2453765f464580d41c8749a5b7dde762bb4a33cc7e04c0f3bee739ed5408faf14b126bd6e334d21ccd3f783289ace140d745123e211321c
SSDEEP 3072:1qYzR052CzeQict6eC1QSMawIDK0Vnu9QssX12laDtmthgv4hUFql:1tNw06XCaOwIJVnuSswAl4jw
TLSH
T1E8E31270FD0CEC69D3FDE85BE10A1337C870AEAEA3045C8976C25509F5C6A690D62C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

d2c23a27-2256-4829-9d8d-d6336a500633.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d2c23a27-2256-4829-9d8d-d6336a500633.tmp
Size 4KB
SHA256 6d5d4437a7019b29971e80c8adf917ee762347d3693e5bea0d1820b9d98036ea
MD5 09548da4a422a1d2e23fd18bc18c5a98
SHA1 679b535eaabfc90d8818c786139fcf334f9fb5b5
SHA512 982549e6a7a9fe73919b8ac6bec4fe141c1e04778bed3bc54dca2f5a496409b07f2a8f6241fcf40f833ee55dd6e9b35357026a17847cd756c7b93d729f1b3084
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5Q8DnB6vGyvQH4jYQs0bblDv4a:qC0xJPz8/CkqDUDLBfr4jYQs0bb1
TLSH
T1F4A11931B8694DB794B6D585B2432A03CF64B197E621AFC0B9DD1E1C10F70FC1352A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc2f5f25-ced8-4826-8ade-5f58a8908703.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fc2f5f25-ced8-4826-8ade-5f58a8908703.tmp
Size 149KB
SHA256 c0911d4308ad7ac4ce760f00fa4b39fb41a3a3d92626550b77db3ca3dbe0b2a8
MD5 8b47e37de5e4321cd13807e87ca4a2ec
SHA1 b4cb5b24033d7a883bf8c6e3ab665c51c333c402
SHA512 a2e780c5486a7d0da0985a230d73a243bf0203e1f14a66576860a31f3e068fda8cfd74a78dfb2e1f23e2e55df03e6edaac15644eb6bc64ef1478594521d2b9de
SSDEEP 3072:KqYzR052CzeQict6eC1QSMawIDK0Vnu9QssX12laDtmthgv4hUFql:KtNw06XCaOwIJVnuSswAl4jw
TLSH
T1FFE31330FD0CEC99C7FDEC5BA10A1737CCA0AE9F97046C4CB9925A05F58A6A90D52C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

459CC51.tmp

Path C:\Users\Admin\AppData\Local\Temp\459CC51.tmp
Size 40B
SHA256 1d1890dfd3bed479711398c007b61b3fd57e256cd5d9da145c61db01e7ad5de3
MD5 9b7b25dc82a2832fe1faf9526a7d9bb8
SHA1 8e3c5b01d8afaf5912f56ebe351b0b827d951c22
SHA512 0456317364480c7b76884088d2dc4de0f3d4dc62bbf35ef71661ac9678c23d6c40e3f2a6a4398fd77df0ce8f50334eb17b8b7133557b500f8de9f91bda26937c
MD5 SHA1 SHA512

Submit Download

480a19c9-de63-42c7-9cd1-f3ef134cf6d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\480a19c9-de63-42c7-9cd1-f3ef134cf6d7.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7UVP.7z

Path C:\Users\Admin\AppData\Local\Temp\7UVP.7z
Size 16KB
SHA256 d5692ca20c2eeb6094b9d72c2027f0603e4bba8d1bbe8113e79d95eeab1d20ba
MD5 db59eb80a9c080609fc9ccfb0abf5b5b
SHA1 ee241e30958f4c76f67a0967efa10059f9df68f9
SHA512 6083fcc1d43639c50e472ce11ca877e0a1c1b4f5c98317ef01808722233ca62809e16dee2995172132d92580300b228bbac407a12e61bf98df5d8e92e04f98e3
SSDEEP 384:a1IFVoqbkzi/qY81BJOXKuYQF6z90oaWbJT2WUmuUGayXpB:/j/j5XKG654W1i5ZUGaM
TLSH
T1C972D06F58C6F02567F110B7F9BFE01B824B66118DC5E14A592C74FEC1A0A2E20B283B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

En_Bu.exe

Path C:\Users\Admin\AppData\Local\Temp\En_Bu.exe
Size 1.4MB
SHA256 2865dab854ba1622f9b377cb720242aa002a7138c558c5df89227092a1e6ce3d
MD5 3b1d32679c76c55826688f7b133bc214
SHA1 c848bc61d37e11eaa9faf19ccf3603cf82733e70
SHA512 d924e8a1fa06c0a922eac7db6d6eb1cc4a70259f1b2c1833ecc23c4feb1b15527c61ac4fcb219f6fb01fcf159a71abf83ec3d1fb81b14c4f49005081d0d12b01
SSDEEP 12288:i1ixAPAWxHwLMbEeuWHiV3OlUOm9XCnnBe7XgisS6TF3dtWFBZTVlnJ99kkJ//:iTxhHcCnBe7Xg/S6FdABZxlnJHkkl
TLSH
T16865715065C582A3D06901B8CA6CEA61E06FED2D5F6027C773F436B95030ADE1EFDA36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F87A8E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\F87A8E8.tmp
Size 8.0MB
SHA256 b6e2fa3667d56413b282ce8892188f80ede4e42819f3430cad77b91d8c72cba2
MD5 be11d2dfec0bc6f24602923d12565485
SHA1 45f50ab3dbe9e5f1df73c5c4b256c6c34f6d56ca
SHA512 5246d198c4b87b2f0f23876812661c6dd24c717e3f4baba49c4f336513b8a44506e1b00733863c375945a5ac1f3cc5a6aa27cd68508392c6bc5ffae32e2a6659
SSDEEP 196608:jchfr1IVmNV2ltiYFlXVDAfaSMVdJvpEez9WbCZZF:mf2aVUYYnVDMKdJvpEezlTF
TLSH
T1468633B51A6364A92F9C1541F58CE143AC26FF23358D19C94B30AC88FFB0A77EA6D147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCP140.dll
Size 427KB
SHA256 5a6dfa5e1ffb6c1e7fc76bd121c6c91305e10dd75fc2124f79fee291a9dd9e86
MD5 db1e9807b717b91ac6df6262141bd99f
SHA1 f55b0a6b2142c210bbfeebf1bac78134acc383b2
SHA512 f0621977d20989d21ae14b66c1a7a6c752bfd6d7ccc2c4c4ec1c70ba6756e642fb7f9b1c6a94afadd0f8a05d3c377792e4aa4c1a771d833c40a6f46b90cbe7c3
SSDEEP 12288:X3xU+0XySH2CyKSPRBb22umbyghUgiW6QR7t5s03Ooc8dHkC2es8Y45:HxUwSH2CyKaBb22umbY03Ooc8dHkC2ex
TLSH
T139943932BB464DF1E48913B971C9472193FAFC610362E3C397DAF1262F166C6A633A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\VCRUNTIME140.dll
Size 75KB
SHA256 f1fd5f6ec1cfe0cc3b66b5322ac97568bc63b19c1e415b99aad7c69ddbafa33c
MD5 8fdb26199d64ae926509f5606460f573
SHA1 7d7d8849e7c77af3042a6f54bdf2bb303d7cd678
SHA512 f56bf11d4259dbf5d4d1f9fc2ad60ff609cddb21278999e9fa55fe5d74552e8a01ddc55cfdc9bf4b09b3e3130a1356142a24a7db8ec5ea19344de617dc9fa99f
SSDEEP 1536:AyH1qvERANBw6qntn64lqVwhNDyUZXRqtn5EecbC9E0tT7+zn:AyHMMRANK6qtnsVON7JY+ecbC9EyK
TLSH
T1DD73AE5278C48272C1AE49B9017AF612663DAA204FD15FDB7FD8598C9F79AC1EF30213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventlib.map

Path C:\Users\Admin\AppData\Local\Temp\eventlib.map
Size 6.0MB
SHA256 a23369e722aa6da2bc2ba66b8a64146a9a325d7651405718797025f90b437ecb
MD5 9ce0ef95f5acf45919b2e6a7e1023353
SHA1 62716098b54cb18f528f5bf9eaac38cba8da96ee
SHA512 4ba88f6fcba88417e93806aea63be9a33832da60dee5ef4956d7428e3dfeef4fec46ed8e724d3c88267d16509120861e03a312464947f8f8856bf55467d7d167
SSDEEP 196608:p7d2QR6ZID+r8VYEomfzAQWzXMJjmkEJQAWXjRY:p7d2jZID88+EomHjmeY
TLSH
T1C25623E04FDE17FBF85642341169D185AE8FDA5F1A302AC626CC2B621CAE5F59F47E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krpt.dll

Path C:\Users\Admin\AppData\Local\Temp\krpt.dll
Size 71KB
SHA256 208dee6ed0082028efd906df6e56bb5b5ca3148da415816b6cb5cbc8caf4a745
MD5 5f70d1e524d83470bd5db2fa83b77387
SHA1 2a2ab61b89ceb3151a66b6f3cee70023d7f1cd2c
SHA512 8a65b6174d6f5065855044a9c1104760fc01e1024dfa516bde59351f5fc7b57afdb8d5f7c27d3a3963bf320dcf98e34452beef0648285a544e60a9a654b10a47
SSDEEP 1536:GOz9TrIkFJzahxOWlLZ6uRPcryxMQQCNk:l9IIGhxtlXcryxMQQq
TLSH
T1A1631A12765583FDD96D12B03F7B67A6C1ADDE348FF201C7ABA20A8985206E72C31B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

proxy_server.pdb

Path C:\Users\Admin\AppData\Local\Temp\proxy_server.pdb
Size 119KB
SHA256 bc0e00baa744ba6e9be7c2e1c1887b09188370ff3e5b9f20fcfd4f969cb890c1
MD5 978317e47f2ddfb4ff1b29b137da0daf
SHA1 c0c3f889692dd5cc8c8d978eecb3723dcdc2fa52
SHA512 f0f3ced13343442b324f824ca60de077394865a903e5fa673eb14add90c7dc4c7069f1dc7ee2a818a6595a154c2ace2516e396a0b217cd23c3bcc21a216c057f
SSDEEP 1536:LdELxswM9Pa3nDu9rByRW9QmjCrcSFB0+mkCCLWKM:5E1swAPa3Du9NVlIcSf0gCCLW9
TLSH
T11CC38CF7A94E5901E201FB1BC2FDAD90B9306669664BF466A53A3C316F7C849C04F3D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2144_1482919236\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZoForge.exe

Path C:\Users\Admin\AppData\Local\ZoForge.exe
Size 2.0MB
SHA256 88f76a16d3c84334e456aa67186435f2f80853d82f4d980e0cf8d411ed904237
MD5 516b7783406c3a9e2354ae0c12b1cf79
SHA1 4e9422c8b735e9abc3028b9f2bb90e00d7d6ab5d
SHA512 5d46a8602787fe02b3cdc3a86173289a9d21761abaa1b1ebd90ed4793ce1d2f8b5c4598d02aa80937ea38febed923926b78d79c6aac3e5c568ab9e5578432eb8
SSDEEP 49152:weKyiecOrHunON3+6eHBLKjMaX+O1t6jKMJqT+GA:QyPKGjMaX+O1t6j8Tk
TLSH
T119A52A20B62AC57EE84631B09C2C4B3AE13CD760CB1A96CBD2DCD55E1C552C3A7B752E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1876-34-0x0000000001920000-0x0000000001928000-memory.dmp

Download

memory/1876-30-0x00000000746D0000-0x0000000074718000-memory.dmp

Download

memory/1876-33-0x00000000746D1000-0x00000000746EB000-memory.dmp

Download

memory/1876-31-0x0000000001330000-0x0000000001337000-memory.dmp

Download

memory/2244-50-0x0000000001100000-0x00000000014BD000-memory.dmp

Download

memory/2244-52-0x0000000001100000-0x00000000014BD000-memory.dmp

Download

memory/2244-58-0x00007FFA8B980000-0x00007FFA8BBE3000-memory.dmp

Download

memory/2244-63-0x0000000001100000-0x00000000014BD000-memory.dmp

Download

memory/2244-64-0x0000000001100000-0x00000000014BD000-memory.dmp

Download

memory/2244-65-0x0000000001100000-0x00000000014BD000-memory.dmp

Download

memory/2244-99-0x0000000001100000-0x00000000014BD000-memory.dmp

Download

memory/5292-59-0x0000000000D30000-0x0000000000E90000-memory.dmp

Download

memory/5292-41-0x0000000075A10000-0x0000000075A58000-memory.dmp

Download

memory/5292-43-0x0000000075A11000-0x0000000075A2B000-memory.dmp

Download

memory/5292-42-0x0000000000FA0000-0x0000000000FA7000-memory.dmp

Download

memory/5292-44-0x0000000001400000-0x0000000001408000-memory.dmp

Download