hijackloader | b14d9f4c8e991a44ba5e9d6263779ce63d56978579758900d5d11cf20a873332

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 06:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ZSfxMod.exe
Size 6.3MB
Sample261113-hpj22agy6x
SHA256 b14d9f4c8e991a44ba5e9d6263779ce63d56978579758900d5d11cf20a873332
MD5 a0a710fd654559527bcffd366bd68857
SHA1 33d9d819e92eeec4cf577a65f19587f6b11c2822
SHA512 ca35cba0a71396cd649d8039a34fae671640d3a8c2087bf7fa8c01f96097be834f6d3c380c37e4793d4579c627a720f8da32848aae8f4c83ecb8f1d202c4d236
SSDEEP 196608:+pzI4aOKO4MzDQ2t3D7Z7ISoXMNBnPTG5cQsyQjdRk:+pzI48OdDFN7Z7OXMbbG5T
TLSH
T11866334137D071F2D0348B3A8F07E7A5A3B3F75916956D4FE7891F1A2CA22A0A2071DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery hijackloader loader privilege_escalation spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\utilityhost
inject_dll
%windir%\SysWOW64\mstscax.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral1/files/0x001900000001e58d-27.dat	family_hijackloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	7ZSfxMod.exe

Executes dropped EXE 2 IoCs

pid	Process
3912	Hub-Crystal.exe
4704	Hub-Crystal.exe

Loads dropped DLL 3 IoCs

pid	Process
3912	Hub-Crystal.exe
4704	Hub-Crystal.exe
4468	ByteVa.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4704 set thread context of 4468	4704	Hub-Crystal.exe	93
PID 4468 set thread context of 4320	4468	ByteVa.exe	111
PID 4468 set thread context of 416	4468	ByteVa.exe	99
PID 4468 set thread context of 1580	4468	ByteVa.exe	115

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	ByteVa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	ByteVa.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	ByteVa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	ByteVa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	ByteVa.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	ByteVa.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	ByteVa.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	ByteVa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	ByteVa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	ByteVa.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	ByteVa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	ByteVa.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppCore\Location\Shifter\Relicensing Statement.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	ByteVa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	ByteVa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	ByteVa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	ByteVa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	ByteVa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	ByteVa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	ByteVa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	ByteVa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	ByteVa.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Third Party Notices.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	ByteVa.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	ByteVa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	ByteVa.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	ByteVa.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\PIUQplugin_v6.job	Hub-Crystal.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ByteVa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ByteVa.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ZSfxMod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ByteVa.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3056	chrome.exe
2864	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4468	ByteVa.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3912	Hub-Crystal.exe
3912	Hub-Crystal.exe
3912	Hub-Crystal.exe
3912	Hub-Crystal.exe
4704	Hub-Crystal.exe
4704	Hub-Crystal.exe
4704	Hub-Crystal.exe
4704	Hub-Crystal.exe
4704	Hub-Crystal.exe
4704	Hub-Crystal.exe
4704	Hub-Crystal.exe
4704	Hub-Crystal.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
416	chrome.exe
416	chrome.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4468	ByteVa.exe

Suspicious behavior: MapViewOfSection 1 TTPs 5 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4704	Hub-Crystal.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe
4468	ByteVa.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeDebugPrivilege	4468	ByteVa.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe
416	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 3912	3956	7ZSfxMod.exe	84
PID 3912 wrote to memory of 4704	3912	Hub-Crystal.exe	89
PID 4704 wrote to memory of 4468	4704	Hub-Crystal.exe	93
PID 4704 wrote to memory of 4468	4704	Hub-Crystal.exe	93
PID 416 wrote to memory of 4240	416	chrome.exe	101
PID 416 wrote to memory of 2176	416	chrome.exe	102
PID 416 wrote to memory of 2176	416	chrome.exe	102
PID 416 wrote to memory of 3056	416	chrome.exe	103
PID 416 wrote to memory of 2040	416	chrome.exe	104
PID 416 wrote to memory of 2040	416	chrome.exe	104
PID 416 wrote to memory of 4988	416	chrome.exe	106
PID 416 wrote to memory of 2216	416	chrome.exe	107
PID 416 wrote to memory of 4988	416	chrome.exe	106
PID 416 wrote to memory of 2216	416	chrome.exe	107
PID 416 wrote to memory of 4860	416	chrome.exe	108
PID 416 wrote to memory of 4860	416	chrome.exe	108
PID 416 wrote to memory of 4664	416	chrome.exe	109
PID 416 wrote to memory of 4664	416	chrome.exe	109
PID 416 wrote to memory of 4192	416	chrome.exe	110
PID 4468 wrote to memory of 4320	4468	ByteVa.exe	111
PID 4468 wrote to memory of 1580	4468	ByteVa.exe	115
PID 416 wrote to memory of 2152	416	chrome.exe	117
PID 416 wrote to memory of 644	416	chrome.exe	118
PID 416 wrote to memory of 4320	416	chrome.exe	119
PID 416 wrote to memory of 2864	416	chrome.exe	123

C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe
"C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\Hub-Crystal.exe
  "C:\Users\Admin\AppData\Local\Temp\Hub-Crystal.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\ProgramData\utilityhost\Hub-Crystal.exe
    C:\ProgramData\utilityhost\Hub-Crystal.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Users\Admin\ByteVa.exe
      "C:\Users\Admin\ByteVa.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4320
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1580

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:1752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9134fc728,0x7ff9134fc734,0x7ff9134fc740
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,9255505844790085002,4783743740204227302,262144 --field-trial-handle=2024,i,3293106196925022044,6297000680261346085,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1612,i,13440206456856646969,10518810586452702829,524288 --field-trial-handle=2024,i,3293106196925022044,6297000680261346085,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,780397466350001514,1574149425624207493,524288 --field-trial-handle=2024,i,3293106196925022044,6297000680261346085,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,9935683234196255726,10066861559031213627,2097152 --field-trial-handle=2024,i,3293106196925022044,6297000680261346085,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,2051489558465768986,3599262068352116943,2097152 --field-trial-handle=2024,i,3293106196925022044,6297000680261346085,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,5862981207998654753,2413624869753657326,2097152 --field-trial-handle=2024,i,3293106196925022044,6297000680261346085,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4672,i,3892057556447039855,10094970310420808653,2097152 --field-trial-handle=2024,i,3293106196925022044,6297000680261346085,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,14714976098641476310,6133462749718348919,524288 --field-trial-handle=2024,i,3293106196925022044,6297000680261346085,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,6465002985400436177,13808536623963016732,524288 --field-trial-handle=2024,i,3293106196925022044,6297000680261346085,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,4461005867086125445,15240455044162888102,524288 --field-trial-handle=2024,i,3293106196925022044,6297000680261346085,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,5537581081484208523,12111134121020029238,524288 --field-trial-handle=2024,i,3293106196925022044,6297000680261346085,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1612,i,7640935611091931538,17679723031534392391,524288 --field-trial-handle=2024,i,3293106196925022044,6297000680261346085,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b7b6d48817fd7e000bb21e4604322961694e381d

Path C:\ProgramData\Jovise\Cusak\b7b6d48817fd7e000bb21e4604322961694e381d
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

48e24036-9a8e-4589-b9b3-5fcfa69f5464.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\48e24036-9a8e-4589-b9b3-5fcfa69f5464.tmp
Size 277KB
SHA256 a7e51a114879aba39a98c68013565a27775fafcd2cb143bd147ded7dc7725c22
MD5 d9186906e7b2689684bc46f041e3839b
SHA1 718267acd401d8da2e77d1fb159a5e32d2e45306
SHA512 3133c7696573382511af5fea5313d87ab1634859b57370fb96f0dc893db849a08f8b7e023c4a334598f0bc5f7f29286c0047fb9b37a6fe858ac020acb5fde53d
SSDEEP 6144:+OEXv3mLZtwBQBzMrdMclATO5+xoVdEM2hG+hFD+7t56OD9ZfSApprl:3PLZtwBQBzMpMciTSIoDFYGyFSXD9Zfx
TLSH
T1BA542236BC05EC77DEFCBA00E25FB3008DA56AED8AC96A0D81865789506FC5D4673C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c8eff35-7a7a-4003-88df-c31e4de688b8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5c8eff35-7a7a-4003-88df-c31e4de688b8.tmp
Size 276KB
SHA256 cb51ac8fba8b2bdd54338f54a8734c7181aab78917315199d238728137ee8d86
MD5 5e019ae46711dd7d83dfc3982bbfac64
SHA1 a697402b6f8f3a9ad6621430b1702f05b50ea672
SHA512 7bd0bb698a8f20c6234c0283eae8dd7b17fe57b50ab2254331c99083d034d9cb91f998334fc8e2b9a07f6ea7588bafd2bdc7b3f05cfa3bc11940861b0cec3125
SSDEEP 6144:q4EXv3mLZtwBQBzMrdMclATO5+xoVdEM2hG+hFD+7t56OD9ZfSApprl:q4PLZtwBQBzMpMciTSIoDFYGyFSXD9Z5
TLSH
T1B9542236BC05DD77DEFCB610E26FB3008DA52EE886C9690D81C65789506BC9D4673C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Breadcrumbs

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Breadcrumbs
Size 1KB
SHA256 bf8744e115e8b102efa47193c31ec5cb55512f7f5051cbed83d7cebc1cb34349
MD5 ecf415e7bf0a0b3fe46caa892f7264d3
SHA1 e0d90a670a75df9084beeb523c1b58d312a23ac2
SHA512 b665b68b5e1237727a4111a61c100a64316d8f819c91f03d05790c712d7980c9e5bb9ff73e7b879ddb36a37cadff1e7e56083f28347ce8c52f69fcdf577f6734
TLSH
T1C631A2EA23B26E09D252B772B48B7FDFB443E56542CCE6FCB5C03B25E519861C256203
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 4ddbbc7ab4606c8d0b95f3e17b97a03bd3dbd3c6ffb19946ff256aca1cd9d99c
MD5 d9ca035600363e5f34f0a926d6f96197
SHA1 40e5a1a9407329cc4f04219ff635e1d6f5c3a5ab
SHA512 84680687309a653e145b4b278912160fa712650663d5c6b9d330dc9c7754f7497aa27bb176c24421ca04c3d803b21974388e25c79aedcd4ee0268fa8a9c57d48
SSDEEP 24:biXROMMBS+MkIYWIEW9tdRc5DOmSMQaeB4iihSgW0PpbW:biBO2+MKWIEotdeDO1Tp5ihSgWObW
TLSH
T15125BE05FB486AABC0438530D8AF17607A74F2D65B434B9F3214E61F7E9F0884F42118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f98b218-e6fd-442d-898f-687a1df11f09.dmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\6f98b218-e6fd-442d-898f-687a1df11f09.dmp
Size 617KB
SHA256 7c1f6238534823be31a6fdb4d336702000d61b9246e2952fe0f8a211a82f7298
MD5 42b617116f9efa2d08eedfe0865e3852
SHA1 8207b1243e60bf92c8b9753be2242afec28ff1bf
SHA512 8c2814a371144d408cfd77f749fd531478a7f85880317915a266dd71ba16b05f4fd589829d53f173e70435196f7f35298b90f3d44015bf928779d470609533f0
SSDEEP 1536:xjjtC/IapopehujHYeR7XpmzAAthy+9V3+pxgY4VigBvt5oF93I6WwbttLw35+dX:xNlYk5mzAAtgiA1qYPJIrW
TLSH
T11CD40B27ABD54916F034923C86D3AF30FBE3EC8C47B6479A329491A9BD572044FB6B44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4804f5345dd7a1abbf91d44a7d836e7cbb1ee9fa6385975e53c6f8ec96c6c47d
MD5 32c88c9b05a228b002f5b75dfb4c0817
SHA1 3cfbfb4201df76afff930c067ab2c233fa2beb39
SHA512 89395192d03f0f9a91b688fc636f3d51b65a076c4acf3bf3ba0fdfc95cfd25b45ed242cdb8af832a41a19e32ea5d26632a963197aa1d5794faf628696e9cfac8
MD5 SHA1 SHA512

Submit Download

7d4b775e-9624-4606-9fe3-e6cbbfdd3ae2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7d4b775e-9624-4606-9fe3-e6cbbfdd3ae2.tmp
Size 12KB
SHA256 47fd560e91003a549ed2d77eb90861197758b9b83bd16ff7290dc3ebce10039d
MD5 88355d64d84a24be146c4ad71599d245
SHA1 7911b1300d10a588f89b4e89583e5175e778136a
SHA512 3214833b0119a560aba1cdd18ef9ad44d27e3bffe4bd940bae8306d15fcb3f0e56c7fb58f586e173f2a1eddff3a3deaeb1cad6cb0f7f31629e79cd83feb28d03
SSDEEP 192:xRX9ROSRoUNv7+pAPRp289THsb+WNnrg0SdCwkw6qRVyIsnAUgtaJ:xRX98SftaUX79wc0aCwa88
TLSH
T12942922DFA10753B5CEBD22AEA21BB53D7F5103164941E84EAFC893C29EB5DC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9709b120-94e3-41dc-b1c1-a01cf564de3a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9709b120-94e3-41dc-b1c1-a01cf564de3a.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 6a5670ded71985a82c12600d76054158fd6df47ebae06b42137baa432699b7a3
MD5 6bc916224c5d69dfc8790c3402a86750
SHA1 dc1eb1f8b7a964d66d58f0bfb3136a8987ac9580
SHA512 f48d7ece7ccb4844913a08b247f2c93fdf825433021e166864223a10da229c856e218d5b5b01b89512dc70503cfb85a1fa5f726c7405578963c8b1338432399d
SSDEEP 6:/FdcQyStsG5CGRU5l/NLBDMtyk0X8AdKyD518bKcX1tjr0EMJ/:ddcSsQzRU5XyytMA5lMK23Ng
TLSH
T18113862C23842E26FFC3E07E155F07B52372D2DB949187034128F27D1007318D706005
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 02de0f36c8796f9b29d95f7e2163c1e434edb104980e4422ac4049bc1efafc92
MD5 cb07ee9dac067d5eb88a9de29542ef5b
SHA1 24bfc48c8c638c31701b959268fcf8b79c4a6654
SHA512 d08d863d086b99507e89a3765484f5eb917a3ddf802b64f58c029d415544555e21e0bddeb14abe9b8955cafe2aa580bf4c89bb4b6d50336e109f202d0e3b4aab
SSDEEP 96:8uYylughGCZjPkVOLHKWolzk7ughqzNjL:vYylE0YSclg7czN
TLSH
T19444E7FB1805EFC6EB2DDFB46C80D2388E3253232DA56E75F23484A155585F73228966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 b78309ac78b09b4c1a2cf5ccb68886f6080c782c8383c7495d296999b9b913a1
MD5 17f897f3e1a5daebeadbccd17af28839
SHA1 82338f03340eee62144acfa8d15bc329b24b3231
SHA512 94772466ddf9ab0ebffb92a8bd76fa504478262aebe6a27a2ca8458a411f73093d7c84549f76fefc0e508a9f7a8c9760f55064181b06baa87ee40b94b8fa0e72
SSDEEP 768:wUfDPLSgcRUv+cUfDPLSgcRUv+/fDPLSgcRUv+7UfDPLSgcRUv+/XVrqwq:8v
TLSH
T1A925D89A0F187EC7D792DA70EEC5C8683DB8229DAD979C82E04186B555C7FC60F8134E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 be3397908f0b4102a73f62fdf6a97653cec310b451bd5a6c0867788a49265fcd
MD5 a453fef7ce64ba889a4dd77e4608276c
SHA1 b063d1fe811e4c6c2f456e18a395e43d0970976c
SHA512 4b67ff80b94a6e044914c7629ee768794e5a9e9a54b7199656a9d7f930626355c5e7b9e57c77e2fc109117c38e1f159cd11dd2fb0f6a4d670181ca3872d3a9ca
SSDEEP 384:yi4/ZS+htcOzdZaKivp/KmvE/lq/ZS+hwc/ZS+hSdkVuN9OKpEzXjqlLljgB:V4s4tvzdxivp/5Vs49s4SqO9ZpEz2lK
TLSH
T11B169E135F2CB142FA89BEB0B6CDEC1C7D742392FCA3A482A217897608F17D15A8505E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 8KB
SHA256 537a722985ad877190ee105862d7cd2a39a202eeead59fa528cf57d36761068c
MD5 23e0555e055be1990adb0bdb0a3d3b57
SHA1 89bf3dc4bb17a0c1c6ed9ea7ba7b43948ca9a4bf
SHA512 e3e71f63730663ea06be77c2264fc58ab84ef687569472c7d3a1cab5ba634898308d27b34b3b10366fc12f0bbf6f5acf1722a965423a3e438a64b1d77f584454
SSDEEP 3:OlH/ld4dhMld5mdT/0oWqy1Xa/Slol/bT7RcAllkvqK1caa+:KQdqYdT/gqckSW/bTVcAl+
TLSH
T1FC028C9AC9050019C0C0E53ACA8207A0D3010AA0834C2E04464E79A0A05CB2015FB488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 ed6d18e4cf3e87395811b97e28effd8b86fac0047a588ae99f16059507448241
MD5 31a3641e8d3fdba42e7625b432b0d187
SHA1 e7b0d4019b4a772e90bb0934f1afb5884aaf5c22
SHA512 5deed7486a198ec67e37c5956a0f1265d9fb5f3707a25c268ca9bbcd51fa4916c994c82494d8b4de7be1ebddf701ebfb998acb064550600fb105dcf8ae23bd73
TLSH
T1C6E0268625CAC56DA45C952306B8634CCBE128A1B3C638462785C8C43186A0569A1380
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 1KB
SHA256 7c5ef5f5e9f790592db55f8373a477089371c5805485f29060313f0203ffe300
MD5 ec036a3e30babef035fc677c2526f9b1
SHA1 c15bdd509aaffd238ec668dd5bef0aa82f48a178
SHA512 41b4ada51b247b763d446c46c5e952c8802675d30d7c42120b04dab70963f1077c153719e8bb0f5e76dd5c7e87f6db2f0476052a69bcad1002fbdfc79350399c
TLSH
T1D921F1CCAB443757DAAF5D395E9663421F61D9F042A0099723E88C731D86BA26723099
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 305B
SHA256 3acbfb173b83f0c702490da806092f869dd24f0c42317103fe64564bc014c863
MD5 910dda2b1b449ad349de247011127c01
SHA1 09c70d6864ab582cb8a6fe336b2c81ecaa5afaa5
SHA512 6bd709d328129e2ccfcdc08792a62a942c6b6a9255c14652f91894251ba57e383ce0dd9450275314081492293817f832ae9ebb63da8035bef35d9acdc777b3d1
TLSH
T16CE07D0734DAC66E4148810B06ECDF8CC6C82441F7DA358B3741D0CC5082744F1F1341
MD5 SHA1 SHA512 TLSH

Submit Download

8bf282f7-25c0-4c05-83d7-a7e0f96fed31.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8bf282f7-25c0-4c05-83d7-a7e0f96fed31.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 e612fd710756a6286ad770be3a2e8ecfde320402652af4e4af88af62d6e64a3e
MD5 2a28abd450f63c3cb4b0701deb787fbd
SHA1 7b0e0fa2aa85d4f730279166485b7e12d053530b
SHA512 a946499fb60f2594ca5f79bf9f832df90380f2fed8a2c2096f718b0a47b7960c985d1318b1b9f965a43ab1e04037ca5d88172cbe6cc1c44d382211e10a9b8e0e
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoOM:OIEumQv8m1ccnvS6RG
TLSH
T112F2E1FF07197601C0E49674D6810ECFFD2D052D4B9BBEC09AAC05F3AB865A39538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 7c74fb0bd7e5470f6565e9dd6a308bb909cd7b99a9068f1c1ae61bba963e6418
MD5 657af5821778c70d6cbcf1f17e2db205
SHA1 38f8417019d7db44478a6c6ed4d36f2da5b3c3ad
SHA512 167789d2709abdd9db8ea3acd659a083de13a39f680657b05b5ec52b36941f711d5241df2e59887228124fbdaa5063de7d5df9891d2536a52ea440dfe7574962
TLSH
T1B2B012C4C0419701C41202F8126028983658DF20A606270141F00D02CC36150801B099
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 863a77f801b0c6c00ff35f3ba812031ddadfce3f43559f6a04c9a7511bff2b2d
MD5 fa77313b6a2ff74c9b28f5c7f44e0df3
SHA1 8c52b06ae5013340a103beb67b20a54a9b7f105c
SHA512 a9785336f4c220d49e071a2c722c04ddf818ae97bff059590b29baa3ae8abaa64298e386decb89a7a1140e1cbb13acc809bb855c69c7258eaf5c84f64da68eb2
TLSH
T1CFB002D5D1536B12C28603F029D995F87160EF69C603631797E02E77DD266B08D656A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 270B
SHA256 3530055a62ddc24a89dd97751ac9db187d009eb8193a29a3636cae2567d4a4cd
MD5 70ef71dd0fed6c14b2b6e149267a2c2a
SHA1 b8829ea9631cd5e0aba87d81e71047ef5fa92f24
SHA512 2ed43127bcd5443c4cd04a01f70de06c50fcef1f284ee4dfec07e605133aa5cd6a1e197dbc0c6e73679af491b976a7304e8d38d58c948cb55471399978470241
TLSH
T1F3D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 7b49331d03e020e53192939f5753ca783572e2659209d7cca25221c3e42680c2
MD5 edbc9062ad6170f8fad8b98ee26205cf
SHA1 526ccd21581313126951ada8b5343cfc3a93701d
SHA512 70a143282eff1cf2b452ee316d5d623c715df586911f39c0b8618b6417a1dd213b5ea04779ed2f2276735be5de311059c73c8891a545d96635e93b9dc144078d
TLSH
T171E0869526CAD52D555DB12B02B8774CC6F42805F7D938462742E4C462C6D05A6F23A0
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13439026532266402

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13439026532266402
Size 2KB
SHA256 38cb1152859b1c73371a112185d51b7683379babbc86dd57adaf8769bb9d5b42
MD5 4d83244dce9a74904375e7787ced22fe
SHA1 a471a38a5793fb3c4bcde72975d8ae6f5adf20e6
SHA512 1e5d192b0aa90b31df8f12d707b973d4eea968fce4dd0e3fdd4b71c85e174bf01894979499ca2ac78cc2897592dee36a2f977a094a5915701a1b9f06c0892aee
TLSH
T154516C125AD8043EF73FC23941B112F7AE39BA496586CD2B657143440C63A433FB2EDA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 e95a640d52a16c37647d6b992b24b5cf40ea7647947a8adc663dbc52a6e68688
MD5 7b3c3265ea8a7325fc2e41b32f48d5c5
SHA1 7a028a3e7d215aa1e6c5e4dc5843fc607e5cb3d1
SHA512 c81d114cbb276daab5fadc848b7500d8842d07bb8960647872d7ab59cd3e18b49c4fa55ca5f56bc63949f1861f345d7528f30f7b34bdf4eefea60eb5db9f07db
TLSH
T1DBE0202529CBCB2F524E412B23D4EF9CC5E16405F7DEE5573F44E0C492C57847581240
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 b5a4c7845e9ecd19bc1eb221eb8fea973773022b31c819e79697f5b2389560b2
MD5 68d19b6c6c2371de15b4f4e563370825
SHA1 5d2dc8cf0ead3fdc5e10212cb511f5824b80895b
SHA512 a6d5179491e005565c81eb0c98c6a58484a1b7b698f68bcaa8be5aafd96d1926ae6b4f271772deece651d0a12172431e9c2ddc4c901ebf65c04355e1d555e827
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2O477EHVumNn73:1nbZeMrv/hGt4enb
TLSH
T136D3754B7A743102EDE58A722CE051BB5E3C716D8F11A5D438B620588EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 9208b724d239e0097c50220848b4ece2e8f052b3bf2101fccfbac04275531965
MD5 82a7ec89a56ed470c563c5e6c27090f0
SHA1 78c2b6d629353e838a4f9fa6bd5d11c8cc56a81a
SHA512 1d997f898ffa117a9550d8d235391f2d9e1f5ce1d7741c54026c02d4df57c6a381b6999304652a51a26d23bb5b27555000d7eb0b890d733550a60c438c9fbbe2
SSDEEP 96:f7doKsKuKZKlZNmu46yjUKVXwX4Rr5+XvXZMrT:7ZT0nzXggtfET
TLSH
T1AF031C8F662840F3D0B6C23EE98645D6FC7C6608A7237EE519E907615EAC13750186AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9a17e87-c8b4-4c01-afcc-f6cb7559a92b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b9a17e87-c8b4-4c01-afcc-f6cb7559a92b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

fd2905c2-a56b-4343-9011-34f9c2af51a7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fd2905c2-a56b-4343-9011-34f9c2af51a7.tmp
Size 414B
SHA256 a9762d7a518f5aa48e2120c984ed72913b6bd996eac11da4ffd61d62b440892e
MD5 5dd1a765563bcdb5e2dd713dd9734318
SHA1 32cec878714c56a93b26a5d8c0e7dc63f1e79edb
SHA512 691a65d48c30c037dad8f2ae7160273b811bfbd56b81f7f86f85d101e141344155d1af9afbb69aa5d9b18792ea427c471fddbcbde5abeab8c1025dd9d9a91d5f
TLSH
T199E02BFEC922F82719FE0B5A54545B49E74033572A41894F3F3D45099FB173643D581C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 bdbd6091f6990cd295999298b3e57d9a77eb96c121ac986703c5520491a37a19
MD5 11268df4cd1ae1e120f06840a12a57eb
SHA1 0d6d89f51827fe72975d7b46edf0e790465715bd
SHA512 533725eda0e5c13776df9fa8115aeb4d28a63fa77a86a0937ee52165e1ed0602e1c44d329b3f3dabbc40ae2a5fefa167b6d781dad16e7b8f895c02c468076c56
SSDEEP 384:HI+qsdGbHh35QkIIIbbLMIMqBXgeUsdGLpGFhsdG7ROjb0sdGuTdGWkYjX9IlN:2HrQ6URQ0N
TLSH
T101A2A6AAA3741B82DCCBF7FBAC558E2E07639CCD41E6004166965B7F2823F0F5841399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 b32f156cda92ce8be97727c3ee85e5d84666652535fd8d2f573a2868afe554d9
MD5 8f3b352bac16526e310b6514a84538af
SHA1 c1c47d66a09ed251020da95435f74862be81f61f
SHA512 bcf1b2345fa6155dc3344a814a5ae09bfe2a1bf6b14bab5c51ac016e5c53302ccb76de43af8f948f5db0213e15a7af4be9058b1fae418d6e4593c5f9521a54fb
TLSH
T1D0E07D037BCAD66FB41C910701A4538CC7E52C12FBD7358A2F41C0C8528AA4877E1780
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

b1cbcaa4-2525-4ee8-a711-e5c662a032f2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b1cbcaa4-2525-4ee8-a711-e5c662a032f2.tmp
Size 130KB
SHA256 ed87f6346d663943d4818d2623f40c34731dccecb44c7d3effba3930c80f316a
MD5 b74fcdcc67c8bd179282eef0ad88518d
SHA1 4751b184d14bf672d2764f85fd2076a2c4f30557
SHA512 56bc81e699d3161e5ec70a85d94aa7774fdc94e0c230918b732ff4e5664dfbf82b741bcd9ba48842252e6f8b7111333940f4da9ddd9efc6640376397f1a96bc4
SSDEEP 3072:W+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:W+hFD+7t56OD9ZfSAppr2
TLSH
T11AD31232AA91D8BBC9BC6541B157A304DE626CED81DE3A09444A5F8ED09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8c59aaa-6e81-4109-9790-f0e6ff5ef34a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b8c59aaa-6e81-4109-9790-f0e6ff5ef34a.tmp
Size 276KB
SHA256 2f174841c676681e544738fed46675209efeb1128ca46dba50a0ff0068ed59e6
MD5 86bc3e5b17a968d65dda0b2441d41e51
SHA1 529ab8c32bceef25fb55358c97637af7755cf42d
SHA512 bdef78eca4fcf82ce303ca35d6645c0cb883f103b0ae945055254a1fb3772fcc64bf569cb8b76d00e1837cfa06f4181e9988c30d7ecd6083c2d37958c56e65d3
SSDEEP 6144:34EXv3mLZtwBQBzMrdMclATO5+xoVdEM2hG+hFD+7t56OD9ZfSApprl:34PLZtwBQBzMpMciTSIoDFYGyFSXD9Z5
TLSH
T1F7541236BC05DD77DEFCB610E26FB300CDA52EE886C9690D81CA5789506BC9D4673C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13FE414.tmp

Path C:\Users\Admin\AppData\Local\Temp\13FE414.tmp
Size 40B
SHA256 4de412a38a18520fedab9800c36b1fb7f3dac32b5ae29f26f99aa3951b226a53
MD5 9fed446693378a63cabfad1a0c2e3f5a
SHA1 a559c662c3579ba2ef98a06fc3394e973722f583
SHA512 4c8c7d6bbd2c0bb86658f251399147acb88115bed0f1a473a862a379687ec44b7aae8221a76df7401d767532ff3cb5a1ee4b2da68616bd7f20e2d50f731b5efe
MD5 SHA1 SHA512

Submit Download

3PFm9H.7z

Path C:\Users\Admin\AppData\Local\Temp\3PFm9H.7z
Size 18KB
SHA256 ef7351c4eefe473ad07fee15618ca78c6055f607b5811ebfb21de9fb93ca4834
MD5 763934670f564e9daf27b6e879bc0d6b
SHA1 5917918d370ccc85214b8e1ddb70c84a7c2fd78f
SHA512 9bc3433c7fe3e4a4c4843d49c5a080db505bfceaef6392342bfb2d86b513a3f5c93424e0c6da027cf2fcbc8b11722146c2a25bc8b3d47aaf7d56ac4aba2fbc77
SSDEEP 384:hf5oC7YF8MzXKZhz9Ixx+zctL9aVZUdqyuODvRyMItri4E/u5khN:hzYF84XKqozctL9a3SqiFy/Uh/Okr
TLSH
T15882D0B75E18988EAAC665656BE43FE088070676603AD1253918FDFF216C0D2D32D63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\3mYu\VQqNHpvZaQ40\Default\I70tL\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D61BB8B.tmp

Path C:\Users\Admin\AppData\Local\Temp\D61BB8B.tmp
Size 6.2MB
SHA256 c9c7d330dce51f1952443b3bd935f20e5dd76b0c281a365bf01a629446978455
MD5 440905650eb5bce4caf1523a052b8b11
SHA1 d0db70625e81115b8c0426969b102d8329372ab9
SHA512 ea93bd6d191ec0a02a20dd3d41c97f863256225bbcfc7353aa6427af45b0db42f0d8002a40b4f10c8055b5e9ac69b2d8278115974967182d632e0c099f2d7ddd
SSDEEP 98304:kGJX/HhuQPq0oHvpVtM/rachLeAr+CqX+Zu3LD2VtvHNQQsrvuQoTGq3GYLcBLZ:VJQQwp+rz16CqGu7SVtlrsrGBT7h4BLZ
TLSH
T13F66336F14B1B7B3592F1F71E72448A69AC94001DC7F6ACEB7CA4083C9F8502CA6D9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hub-Crystal.exe

Path C:\Users\Admin\AppData\Local\Temp\Hub-Crystal.exe
Size 3.0MB
SHA256 3424c23014e155e0c542757e43207dd35f8a266e50de4e1f14d58339ab53844d
MD5 42bc273bb33d525e9f5aa80ded29cab6
SHA1 350c9b0f221f59c209c6e1a4a9ef3cd880600fa2
SHA512 c537474c114ca78611176e160bdb10b179fa0b7baf555ace3c5863c7bb0572f03f362b0856429e7d999eeb1c721eb3f2789032a090143bc633d4f462618dc585
SSDEEP 49152:Ni7JSce6H+oDnj6nDaCm4n5X41t7a18Ak1PmdRSmi8hZXV8u8vBNjX9a3ieKXFr3:Ni7kqk8NahH8vBdX9CKXFr7fr
TLSH
T185E56B5B66B850D9D4679178C8278E0BEBF2FD621930C39F116937AA9F732710D1E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupXML.dll

Path C:\Users\Admin\AppData\Local\Temp\SetupXML.dll
Size 2.5MB
SHA256 70784ce35e9fa492c08465aff28f6695bdcf03158a380b7b72b91db3a7b9663c
MD5 ca4c3ce97f4cbdcb98cd0f16f33f511d
SHA1 0e4cdf2269432347a5258ff51b1b0a31c1f5d5cf
SHA512 31e8783125880954854af99fda9308dfc7c81eeb4f776d7cb45a121e92415cb07b42ade6efa881ab4876eb51394e8c436eb64d5881cfc4bec4c3f7cfa970eb32
SSDEEP 49152:ygl1+McTAJiV1YslJoM/9ajuZH8YbbUw1lzJp:dBqCzYbbUwR
TLSH
T1BBC57D5AA6B840A4DC9AD174C42B8A0BD7F2B9518A74C75F406113AFDFBB3720E1F325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audiohook.log

Path C:\Users\Admin\AppData\Local\Temp\audiohook.log
Size 5.1MB
SHA256 253361dc590e6c09ef356704b0189bfd199531305a152b46bd3faa87a5e78b20
MD5 d2b87094b9858a18bcec8d8c1148cfb0
SHA1 9d993e8fee71732b8087c0f7cb9755ae5c8d6c00
SHA512 48fc22808ca6a3ddc35d90ecd1d4029b37729d6d81781b1d93b7f416e5f6317347a1fd7ad7c532fb6e7a767dbc176019513958c730b310bbeae8b4bedda777c0
SSDEEP 98304:gKn6Q2VnQelc2YvnNoc59u+ti2tC+dVxogDTb4MHwzeJj3NPt:P6HVnQahEnmH+hT4MQzy3xt
TLSH
T1033633CFDC7C6ABEC0F795B957E713877C90B98E1DB0229892644A997E208D364F1342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

monitor_sync.db

Path C:\Users\Admin\AppData\Local\Temp\monitor_sync.db
Size 267KB
SHA256 5f62e1dd8e18d98ea96db09e28b1dbf595f83533e24138f39735497c72298bca
MD5 30a118999a3285076d35b5202f97ca3f
SHA1 dd23cf9e5185bd8c1e5b51382c896c48612ef012
SHA512 b63889d284c89343df27b2df2c80e717c533e3ff6ae66927843e591295df42c8ae05ddd3ec4d32771c0ead7dfea88d5d3d29fbb1b2e7cbe12e051bcf9bea5f78
SSDEEP 3072:AsbLtklyrXV5gAwW1m/Uhntd/QKX5fLjDKK66c3U+fvZlaOO/4l5Xz04kHPx262L:dXttg1rUhnvyZltA4l5XzmHUZR
TLSH
T1114417A93BD9C3381A1E2B7EB10E91BE14308762167FC7B1B3C75D6A110E144F49BA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 626KB
SHA256 e1a99ac49449ef7fcf07ee571553870f3c7bb8b3fdad97ea93276987ecff0333
MD5 bc127f7392bd82f2937ec7d4eed0c5af
SHA1 b7b0b15ab99b1d14802251d43c0f4e59b5d27ce7
SHA512 1f45664867c05ccde52e13cda262d0f2a90928175cf9477bbd9f2dc8cd9db79323a54dc81d7ffb07ab51c2febfaa557f110c613aa20f57688d055e2fd566381d
SSDEEP 12288:O+TTIwt0B5483RXXoTk4iQKQEKZm+jWodEEVUsS8hx:f8wdKnIkPQEKZm+jWodEEmsSS
TLSH
T137D41827BB5906A1D16693BCA5C74306E3F1BC154721A3C742EBE26D2F2B7C8673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.3MB
SHA256 db6bc090827c93a24ed59bd73a6889f99b284c59e9abc9ad8bf1985d0b6ad14d
MD5 40ddc069a568ecb3f9db9e8a439278be
SHA1 8e4c5187915e3c224e6e9e2e33ff1de1ba8b947b
SHA512 451ac7db53dfbcfc31ed9bccb754eb7066c114de88b752af72c0aae4a0430eaf6eadb2fb66e54cd7564d151cea4af413fa3d5e996a1ab311608b9190832cafdd
SSDEEP 24576:HM6VUOfZDUVOb+uifkfEee3siuEWBlwmN1v2PI/BoEzJszZ7ymxvSZX0ypOpT+R:HM622DUVOb+uiMfE+nzTv2Apvz4VpQ
TLSH
T17055BE6576AD01E9C1BFD139C64B4A06E5B27C1503708ACB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ByteVa.exe

Path C:\Users\Admin\ByteVa.exe
Size 169KB
SHA256 5a1a351578119be3c2db931b0e9e14dcf28ba756176712f592d11fa5ec2ba40e
MD5 636c989c228f35400dabc8a39669073f
SHA1 c7c3d8f77bccdc748443bb3982f2da2f226278da
SHA512 fdbe9a3e62079b61bd366846d361e49a0de6a781f234e269f0fd3533a6f399e5aff19ef929ad4eba448de1eb6bd75293dcad8943ee0340b128d34b83c2c2f7a3
SSDEEP 3072:tOaMMUY9Yf1Xi0XESzwqY/EK18+pQ5QDPCv:tD9scEK14QDav
TLSH
T1BD04192227819575DAEB22B642BFBF29156DAE500B6052C311C533FADCB1BE05F342CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3912-26-0x00007FF9150F1000-0x00007FF91512E000-memory.dmp

Download

memory/3912-24-0x00007FF9150F0000-0x00007FF915142000-memory.dmp

Download

memory/3912-42-0x00007FF9150F1000-0x00007FF91512E000-memory.dmp

Download

memory/3912-25-0x000001A6DF650000-0x000001A6DF65A000-memory.dmp

Download

memory/3912-29-0x00007FF9150F0000-0x00007FF915142000-memory.dmp

Download

memory/3912-28-0x000001A6DF690000-0x000001A6DF6A2000-memory.dmp

Download

memory/4468-55-0x0000000000E50000-0x000000000120C000-memory.dmp

Download

memory/4468-64-0x0000000000E50000-0x000000000120C000-memory.dmp

Download

memory/4468-68-0x0000000000E50000-0x000000000120C000-memory.dmp

Download

memory/4468-67-0x0000000000E50000-0x000000000120C000-memory.dmp

Download

memory/4468-62-0x00007FF931110000-0x00007FF931305000-memory.dmp

Download

memory/4468-53-0x0000000000E50000-0x000000000120C000-memory.dmp

Download

memory/4468-85-0x0000000000E50000-0x000000000120C000-memory.dmp

Download

memory/4704-48-0x0000019803A40000-0x0000019803A52000-memory.dmp

Download

memory/4704-45-0x00007FF9141E0000-0x00007FF914232000-memory.dmp

Download

memory/4704-65-0x00007FF61AB50000-0x00007FF61AE53000-memory.dmp

Download

memory/4704-46-0x0000019803A00000-0x0000019803A0A000-memory.dmp

Download