hijackloader | 1b11e004c2aa485726e6ab8572d0701b78927c2f80d489b82194dcb0cb990877

Analysis

max time kernel
318s
max time network
320s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
17-05-2024 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample
Size

18KB
MD5

f1a85807e472b3501f49b64b0b115841
SHA1

d8e6dd4cd443a366f82628fcf5fa09936ed2806c
SHA256

1b11e004c2aa485726e6ab8572d0701b78927c2f80d489b82194dcb0cb990877
SHA512

c7b3f241ad7daedd318fa6e407703e3368069ebf0064e1e71de868c354fa534f7187a26516b5b425f690db4cd7396066b407242a732790f50debf67b3dff7d30
SSDEEP

192:Ol9HSRnYCBuLbqxPqxKBzuB5BUk0Wjw+W98DEpR/fEZ:cH+nlYrxK52Uj88nO

Score

10^/10

hijackloader rhadamanthys stealc vor16 discovery execution loader spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

vor16

http://89.105.198.134

Attributes

url_path
/244cbe83570df263.php

Signatures

Detects HijackLoader (aka IDAT Loader) 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4940-1490-0x00007FF6DB220000-0x00007FF6DB3C7000-memory.dmp	family_hijackloader
behavioral1/memory/3492-1572-0x0000000000C70000-0x0000000001217000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

explorer.exe

description pid process target process

PID 3992 created 2936 3992 explorer.exe sihost.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

3772 powershell.exe
856 powershell.exe
1964 powershell.exe
2788 powershell.exe
Downloads MZ/PE file

description	pid	process	target process
PID 3992 created 2936	3992	explorer.exe	sihost.exe

pid	process
3772	powershell.exe
856	powershell.exe
1964	powershell.exe
2788	powershell.exe

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
C:\Program Files (x86)\Vortax\Vortax.dll	net_reactor

Executes dropped EXE 6 IoCs

Processes:

Vorion App Setup.exeVortax.exesnss1.exesnss2.exeptSrv.exeptSrv.exe

pid process

3344 Vorion App Setup.exe
4476 Vortax.exe
4940 snss1.exe
3492 snss2.exe
2452 ptSrv.exe
2196 ptSrv.exe

Loads dropped DLL 64 IoCs

Processes:

Vorion App Setup.exeVortax.exeexplorer.exeptSrv.exe

pid	process
3344	Vorion App Setup.exe
3344	Vorion App Setup.exe
3344	Vorion App Setup.exe
3344	Vorion App Setup.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4476	Vortax.exe
4636	explorer.exe
4636	explorer.exe
2452	ptSrv.exe
2452	ptSrv.exe
2452	ptSrv.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 2 IoCs

Processes:

snss1.exeptSrv.exe

description pid process target process

PID 4940 set thread context of 3788 4940 snss1.exe cmd.exe
PID 2196 set thread context of 908 2196 ptSrv.exe cmd.exe

description	pid	process	target process
PID 4940 set thread context of 3788	4940	snss1.exe	cmd.exe
PID 2196 set thread context of 908	2196	ptSrv.exe	cmd.exe

Drops file in Program Files directory 64 IoCs

Processes:

Vorion App Setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Vortax\ko\System.Windows.Input.Manipulations.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.ComponentModel.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Core.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Net.Mail.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\createdump.exe	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\de\UIAutomationClientSideProviders.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\tr\System.Windows.Forms.Primitives.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\PresentationFramework.Royale.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Diagnostics.StackTrace.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Security.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\hostpolicy.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\es\System.Xaml.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\PresentationFramework-SystemDrawing.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.DirectoryServices.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Security.Principal.Windows.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\fr\PresentationUI.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.ServiceModel.Web.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Resources.Reader.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\it\PresentationUI.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\it\System.Windows.Forms.Primitives.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.IO.MemoryMappedFiles.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\es\UIAutomationClient.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\it\WindowsFormsIntegration.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\pt-BR\UIAutomationClient.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\PresentationCore.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Net.Requests.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Security.Cryptography.OpenSsl.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Threading.Thread.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Threading.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\fr\WindowsBase.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\pl\System.Windows.Forms.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Data.DataSetExtensions.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Net.Security.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Threading.Timer.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\de\System.Windows.Forms.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\fr\System.Windows.Forms.Design.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Net.Ping.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Runtime.Serialization.Xml.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\pt-BR\PresentationCore.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.AppContext.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Security.Claims.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\mscordbi.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\coreclr.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Globalization.Calendars.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.IO.Pipes.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Runtime.Serialization.Formatters.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Security.Cryptography.X509Certificates.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Xml.Linq.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\Vortax.exe	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Net.Quic.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\ko\PresentationFramework.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Text.Encoding.CodePages.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\cs\System.Windows.Input.Manipulations.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\pl\UIAutomationClient.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\tr\System.Windows.Forms.Design.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\pt-BR\UIAutomationClientSideProviders.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Numerics.Vectors.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Runtime.InteropServices.JavaScript.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\es\WindowsFormsIntegration.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\fr\ReachFramework.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\ja\Microsoft.VisualBasic.Forms.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\it\Microsoft.VisualBasic.Forms.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\ko\ReachFramework.resources.dll	Vorion App Setup.exe
File created	C:\Program Files (x86)\Vortax\zh-Hant\System.Windows.Forms.resources.dll	Vorion App Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

ptSrv.exeptSrv.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl	ptSrv.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	ptSrv.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl	ptSrv.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	ptSrv.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133604047061265359"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings chrome.exe
NTFS ADS 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Vorion App Setup.exe:Zone.Identifier chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	chrome.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Vorion App Setup.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

chrome.exechrome.exepowershell.exepowershell.exepowershell.exepowershell.exesnss1.execmd.exeexplorer.exesnss2.exeptSrv.exeptSrv.execmd.exeexplorer.exedialer.exe

pid	process
3000	chrome.exe
3000	chrome.exe
920	chrome.exe
920	chrome.exe
3772	powershell.exe
3772	powershell.exe
3772	powershell.exe
856	powershell.exe
856	powershell.exe
856	powershell.exe
1964	powershell.exe
1964	powershell.exe
1964	powershell.exe
2788	powershell.exe
2788	powershell.exe
2788	powershell.exe
4940	snss1.exe
4940	snss1.exe
4940	snss1.exe
3788	cmd.exe
3788	cmd.exe
3788	cmd.exe
3788	cmd.exe
4636	explorer.exe
4636	explorer.exe
3492	snss2.exe
3492	snss2.exe
3492	snss2.exe
2452	ptSrv.exe
2196	ptSrv.exe
2196	ptSrv.exe
2196	ptSrv.exe
908	cmd.exe
908	cmd.exe
908	cmd.exe
908	cmd.exe
3992	explorer.exe
3992	explorer.exe
1616	dialer.exe
1616	dialer.exe
1616	dialer.exe
1616	dialer.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

snss1.execmd.exeptSrv.execmd.exe

pid process

4940 snss1.exe
3788 cmd.exe
2196 ptSrv.exe
908 cmd.exe

pid	process
4940	snss1.exe
3788	cmd.exe
2196	ptSrv.exe
908	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

chrome.exe

pid	process
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe

Suspicious use of FindShellTrayWindow 61 IoCs

Processes:

chrome.exe

pid	process
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

Vorion App Setup.exeVortax.exesnss1.exesnss2.exeptSrv.exeptSrv.exe

pid process

3344 Vorion App Setup.exe
4476 Vortax.exe
4940 snss1.exe
3492 snss2.exe
2452 ptSrv.exe
2196 ptSrv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3000 wrote to memory of 3956	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 3956	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 1908	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4536	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4536	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe
PID 3000 wrote to memory of 4796	3000	chrome.exe	chrome.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2936

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample
1⤵
PID:2312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcca2dab58,0x7ffcca2dab68,0x7ffcca2dab78
2⤵
PID:3956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:2
2⤵
PID:1908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:4536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:4796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:3364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:1284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4260 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:3712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4396 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:3104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4284 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:1124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4828 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:2700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:1028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4888 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:1436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2676 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:1876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4728 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:2944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4536 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:2148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4724 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:4976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2552 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:4556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4996 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:2152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4972 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:1732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2676 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:4480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2824 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2552 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:3916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=2672 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:4580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=3896 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:1120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5628 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:3492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5676 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5456 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:2864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5264 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:1556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5248 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:2788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=5312 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:1
2⤵
PID:1572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
- NTFS ADS
PID:920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5220 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:5004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5236 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:4444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 --field-trial-handle=1800,i,12606871927090223016,674700475194816619,131072 /prefetch:8
2⤵
PID:4380

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1656

C:\Users\Admin\Downloads\Vorion App Setup.exe
"C:\Users\Admin\Downloads\Vorion App Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3344

C:\Program Files (x86)\Vortax\Vortax.exe
"C:\Program Files (x86)\Vortax\Vortax.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:856

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2788

C:\Users\Admin\AppData\Local\Temp\9d761a66-6ee1-41be-8d4b-fb36c62c2e79\snss1.exe
"C:\Users\Admin\AppData\Local\Temp\9d761a66-6ee1-41be-8d4b-fb36c62c2e79\snss1.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3788

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4636

C:\Users\Admin\AppData\Local\Temp\9d761a66-6ee1-41be-8d4b-fb36c62c2e79\snss2.exe
"C:\Users\Admin\AppData\Local\Temp\9d761a66-6ee1-41be-8d4b-fb36c62c2e79\snss2.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3492

C:\Users\Admin\AppData\Local\Temp\SignFmti_alpha\ptSrv.exe
C:\Users\Admin\AppData\Local\Temp\SignFmti_alpha\ptSrv.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2452

C:\Users\Admin\AppData\Roaming\SignFmti_alpha\ptSrv.exe
C:\Users\Admin\AppData\Roaming\SignFmti_alpha\ptSrv.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2196

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:908

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Vortax\System.Private.CoreLib.dll

Filesize
12.6MB

MD5
805cf170e27dd31219a6b873c17dce88

SHA1
ac90fa4690a8b54b6248dcb4c41a2c9a74547667

SHA256
ba7e61a00e7a4634b5c5a79b83126f75580ceec235c613000c3efbc01826cad0

SHA512
fa946aae906b66cb5570155a1c77340f2b6d4efb9be16068da03a8f1c5b5f37ad847d65cd1416017db19375dc6a72670300da4c766e6d9bb1a00374f492bd866

Download Submit
C:\Program Files (x86)\Vortax\System.Runtime.dll

Filesize
42KB

MD5
53501b2f33c210123a1a08a977d16b25

SHA1
354e358d7cf2a655e80c4e4a645733c3db0e7e4d

SHA256
1fc86ada2ec543a85b8a06a9470a7b5aaa91eb03cfe497a32cd52a1e043ea100

SHA512
9ef3b47ddd275de9dfb5ded34a69a74af2689ebcb34911f0e4ffef9e2faf409e2395c7730bce364b5668b2b3b3e05a7b5998586563fb15e22c223859b2e77796

Download Submit
C:\Program Files (x86)\Vortax\System.Security.Cryptography.Csp.dll

Filesize
15KB

MD5
c7f55dbc6f5090194c5907054779e982

SHA1
efa17e697b8cfd607c728608a3926eda7cd88238

SHA256
16bc1f72938d96deca5ce031a29a43552385674c83f07e4f91d387f5f01b8d0a

SHA512
ae0164273b04afdec2257ae30126a8b44d80ee52725009cc917d28d09fcfb19dfbbb3a817423e98af36f773015768fed9964331d992ad1830f6797b854c0c355

Download Submit
C:\Program Files (x86)\Vortax\System.Security.Cryptography.Primitives.dll

Filesize
15KB

MD5
777ac34f9d89c6e4753b7a7b3be4ca29

SHA1
27e4bd1bfd7c9d9b0b19f3d6008582b44c156443

SHA256
6703e8d35df4b6389f43df88cc35fc3b3823fb3a7f04e5eb540b0af39f5fa622

SHA512
a791fa27b37c67ace72956680c662eb68f053fa8c8f4205f6ed78ecb2748d27d9010a8de94669d0ee33a8fca885380f8e6cfad9f475b07f60d34cdcb02d57439

Download Submit
C:\Program Files (x86)\Vortax\System.Security.Cryptography.dll

Filesize
2.0MB

MD5
75f18d3666eb009dd86fab998bb98710

SHA1
b273f135e289d528c0cfffad5613a272437b1f77

SHA256
4582f67764410785714a30fa05ffaaad78fe1bc8d4689889a43c2af825b2002e

SHA512
9e110e87e00f42c228729e649903ad649b962ae28900d486ee8f96c47acca094dbace608f9504745abf7e69597cdef3c6b544b5194703882a0a7f27b011fa8d5

Download Submit
C:\Program Files (x86)\Vortax\Vortax.dll

Filesize
393KB

MD5
db0a77e84caa01503bea132d7e5ef2f8

SHA1
161661df701e4011570cafb8305f218fa4ac3e50

SHA256
41d023a22c052a1d37bda1f34b8cb73d088fcf6abaf00695360f0a3a8d985239

SHA512
02207090569315f79a5d1f35f39e80cf8b05c87c336da8b52f02cdae4732b7acc3f98f1333986c91ea3f09f054efb09605a1427ba2fe23d90e119797b3984574

Download Submit
C:\Program Files (x86)\Vortax\Vortax.exe

Filesize
308KB

MD5
aa6ea1381097f6e1201a10a0de1029f5

SHA1
23b162c564b54fdc6fa2a4e56401bcb0ad98b6ac

SHA256
d1240769ed4c6dd4603a00f1e05b0ec4c1b2951661bd478c1e10954ab3123924

SHA512
584155f235b8567a5356307bc139e82df049f49bd9c4c07baa346fa8afb7be7e6f0afd1eec024bcebf5a7c416934f692d183a2977e8a38666652ccc1c124ff40

Download Submit
C:\Program Files (x86)\Vortax\clrjit.dll

Filesize
1.7MB

MD5
8b81a3f0521b10e9de59507fe8efd685

SHA1
0516ff331e09fbd88817d265ff9dd0b647f31acb

SHA256
0759c8129bc761fe039e1cacb92c643606591cb8149a2ed33ee16babc9768dcb

SHA512
ea11c04b92a76957dcebe9667bef1881fc9afa0f8c1547e23ada8125aa9e40d36e0efaf5749da346ba40c66da439cbd15bf98453e1f8dab4fe1efd5618fdc176

Download Submit
C:\Program Files (x86)\Vortax\coreclr.dll

Filesize
4.8MB

MD5
9369162a572d150dca56c7ebcbb19285

SHA1
81ce4faeecbd9ba219411a6e61d3510aa90d971d

SHA256
871949a2ec19c183ccdacdea54c7b3e43c590eaf445e1b58817ee1cb3ce366d5

SHA512
1eb5eb2d90e3dd38023a3ae461f717837ce50c2f9fc5e882b0593ab81dae1748bdbb7b9b0c832451dfe3c1529f5e1894a451365b8c872a8c0a185b521dbcd16b

Download Submit
C:\Program Files (x86)\Vortax\hostfxr.dll

Filesize
342KB

MD5
16532d13721ba4eac3ca60c29eefb16d

SHA1
f058d96f8e93b5291c07afdc1d891a8cc3edc9a0

SHA256
5aa15c6119b971742a7f824609739198a3c7c499370ed8b8df5a5942f69d9303

SHA512
9da30d469b4faed86a4bc62617b309f34e6bda66a3021b4a27d197d4bcb361f859c1a7c0aa2d16f0867ad93524b62a5f4e5ae5cf082da47fece87fc3d32ab100

Download Submit
C:\Program Files (x86)\Vortax\hostpolicy.dll

Filesize
388KB

MD5
a7e9ed205cf16318d90734d184f220d0

SHA1
10de2d33e05728e409e254441e864590b77e9637

SHA256
02c8dbe7bf1999352fc561cb35b51c6a88c881a4223c478c91768fdaf8e47b62

SHA512
3ecbaf20946e27d924a38c5a2bf11bac7b678b8c4ebf6f436c923ea935982500e97f91d0e934b7fd6b1fc2a2fd34e7d7b31dbbe91314a218724b3b2fd64c4052

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8b93bf93-1665-48ef-8490-9f6e28538a98.tmp

Filesize
6KB

MD5
359f068a1c88c458e346bf367764aa35

SHA1
4f0e44645a8ef9f49ec1f3d604c8872de176cd28

SHA256
f968814a73082a83929802937b252fe9a3157d6bb11cbbf6e62781ca89599eda

SHA512
63b8ef9891be258b3739ae6e9d222d78fdbb9606cf064ab99ba3c09bb7c7f7068216e2acc67695ba972440bceabc80222bf96f089497ebe3583033125dffc8f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000051

Filesize
204KB

MD5
41785febb3bce5997812ab812909e7db

SHA1
c2dae6cfbf5e28bb34562db75601fadd1f67eacb

SHA256
696a298fa617f26115168d70442c29f2d854f595497ea2034124a7e27b036483

SHA512
b82cfd843b13487c79dc5c7f07c84a236cf2065d69c9e0a79d36ac1afc78fa04fba30c31903f48d1d2d44f17fb951002e90fb4e92b9eae7677dbb6f023e68919

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
62d4c2b4bc1d3d3f32546599115df0df

SHA1
9a0aa51c8ad57d9e18feb7c2ed360fe35bee78b8

SHA256
089c0bfdcb3fed4e08b56ab124b10785b9d74d56a06e88c576119c5f1a4d7b0e

SHA512
8834ce7150df846280fb396b43e2de508198c2abde26b69e68ffb812736ba0285a5976177cc2c44f2c56614139e5ca3fa8fe13e4e73125cd070beb929bc043df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d52ece11d276c6dd0a49bcd78901da21

SHA1
86bf7d9425a356455003742bf3ff3721de306ba7

SHA256
e2f0be605200ffaf25967a6008f3da9815d2ff99155c9db5433105d3369d9503

SHA512
ad99cbe480312d9f16024934f78dc7d8f4cf7b734d6ee5c7340738990d7e95184c5e528d8347c647562a177ea9e36d600e2198ddad08fb5a0a86b91415003632

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ccba136aee0d9f4b85f464ee2948ea5d

SHA1
3126729258d9b77f23a3500756ecbf62242f5de7

SHA256
d027cab79f8a551d4296aaa43a45096e0530c1b12c8b1eb36b3dd539e9ee4cbf

SHA512
5084e36352a5d574adf434f909cfb0b3cf80535e9fe8884e1274f45d630583a9586240c1b61c8515254d8192489688d93b59af44ac8726aa3f0d2e66f37b6975

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
6045a47d3ec3b095b9cb1648c99410ba

SHA1
5e3572713348d895a0b594abb4f2c4cd1f3b7a1a

SHA256
e8147735461ed094f0988fe0d507a8fcd2595e130bd0f15fd8a8a6dcbbb81a22

SHA512
937fb73481e7d21b2770b77a7cf9bd53781e415a8b93e68dd06e160275cbf516b1fe60e837984e3760e08f3408726a34d62cd4230aa36404d8fd0ebf01a9f2e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
901c2fd1ed9e74e043e6cd6586c9e17a

SHA1
f0c01d789cb0237a9eb8a9fe2e94926073905465

SHA256
a9c034429ae4c34e3f7cfb099c2ec26e83e04e35a8b3026eee94c483448ec5e3

SHA512
ea33ec42bbbdcd25b2b26fcea85978466d49ef03c26569b93964fad558cb1bc227ddfc4b7731452187bae1881cff7625b9b3b7aa21ccb99a0aac3f6aef5e5a86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
9e69188f7576b78c453ef2842ff791a6

SHA1
1a9cb430ef6e27e24adce80fdaaecc9defdc2507

SHA256
462728a70ee2274a2051e0d8a81bc0e24e9237967b494f211ce2a3c95ede35b0

SHA512
650332f872801c4b1cf90d1ab781cf2d8d325197702fb0ceb610c617547df14b143a375fba4d27d7c2cf381dfdfdefc05d8a4ba9cd0895f6f2be8eac98a5d855

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
be6533091c920e14501c6d068b16def0

SHA1
da780e5279a319a7161406abce5c41c14bda3b15

SHA256
6a801ea7ea2a3ec29f66db81b4d72e4bec0491b5907fbed5814904550e19be0e

SHA512
fd5dab2778cd912b45a0733a91f9a7631c89458affd3d7d2581ff4d751c11436dc696a40fde1a76ca9a334c79d31cdcfb7f176cbbef869fbe7d830ee1d63fc5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
93a2083026aa62b24657a8b0d84e7d35

SHA1
42de10ce79e233b4e18c8ea89f62945ae54f9aa0

SHA256
d5af871021f5cd28a79b16eccfa5ee628ffa7e7e6b8a499e36bf2457a688ada8

SHA512
af39561d26e78c79a2efc262740cc55678851fd51dafffa99019ccde3c7755ef8fe396b79afdf0843652b6217825068cec514a3b3d941fa3ad3c12d838945cd8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
e1a042fcb6ca40ed1d2cc9ac4e4b0249

SHA1
32b15f4cc4f31b8629aa9b44c8cc21618df49478

SHA256
961913d85d604bb76b5989e6efe94742ec0b15fa141244bff751d7972e9d2702

SHA512
99e31564bfc4d40da87a6c155e8e13ed5435e6b8b0aed4fa23f03d53c12e2d68d3b60aa097c9e7a6255c83d127bbcfa39840fd3646a903ac3226b234dd68d7b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
1a2e4cf31bba99af0047f924e866df77

SHA1
49c2edea26603f7dfac6aac244e3ac8899f65ad9

SHA256
687e68a52c5e80fc5cf3405097235341d585ee0d06b0aa3fb80cfa564a6b6c63

SHA512
9ef6349344433e010f3337a614c00aa662e24bc691d233223c991ccb77bfbe7f70e324f3d29a693c7138fe5c361501b85651c1a55297e614008ca62eca73f795

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
1a1ce43c73ff31f1a951a2c8d42cf744

SHA1
e34e60ec6df8d419f04aa5f19a591d64b5f10798

SHA256
775b5100e120952a8faba72bf8087d50347711707c6b12d6327ca5c924ae0859

SHA512
6dde4a073b6e325c9effe5a80df96fef478da9f90037bf9f7e9ea78eda75265869c66f73aaf239b989def2862046eb63f19ec5d96385e10ea78c304f90f57dcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
c4ec4cae419867d3d0f80295b5a61170

SHA1
8591236e612ccaf15208692066f018a7320e5d37

SHA256
b50ab8cebe7122ac07e14905ad546198b3fd74c712d0510c698f683adab2b39e

SHA512
c868d7458e60a626d62e2c7f1f5a52ff41c69f16a3f2f6a40477ee79ce89fac73dcdab148b4748f728b346a51e05b4f8903021a22d24279525c70a5c1b3b57e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
3f2a36bd240a45f5cc139fc6046451a3

SHA1
818508bd6df54db40ca07019faefa6374bc51732

SHA256
57a33f95fb033afb9a3f93d15bf8fd0c75e91d4087e7a5f276b47dae2a74ed49

SHA512
1fd1c910190aea0d59799f190344eb65f2fea0684c8f508c9b04765f28728f63f08dad5ac14006c57ba2b6aab4bff6e93c02d073fa56da2349dfb2799fc8c968

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9ac7f32152fa483e9f69d1216f32d333

SHA1
1a972b4ec64d3b94ed540ecc39cdc298203fd8ff

SHA256
0cbac418255f8d2d94f559eb646fd7b3f4ac3f269e7b1ecfa79bd5905343fb25

SHA512
7c5c31f931dc696a38697353316b33afc00db0fecec16508f77f369ff9650ae8fc57ebc443101e552d930df9b727e7078667ef30179cbbf1950f28f8fdba0a55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
7f383d509f0ad3da3ac0af604bcbaa89

SHA1
30e81d8320c042bd96df9ddcdebfa13d1e060924

SHA256
1a2b86f184fe6e890c4efd9ae8b381b66048d58bc26657e7e22f3c4fc56018e2

SHA512
148f5a3c9c321dd1ef01da25fd5eeeed5c117b8016aa66951ebc0f8b7ff526581105959d16cfae2b6d7849d26e9a9e8b5b84824ba92d4f6fe29534778e2b9b0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
c64a3a3b81654d46e96ce4ada95bb8ed

SHA1
4bbe8fc4300142ad6a3edb4b5b17967243278102

SHA256
4990e58cb05dc64a864283ee3ad25bda9cf3628ba557b7cfc79eb5eb2369ebeb

SHA512
f7a73582a4421a553a7b1556517e00c38610ecac3cd4371286b15fe3d3d7ac1d5b2e55b5b624b3bcbf38f8ac66b3f464a3915a0e5728bbb5e1fcc51c795b1a56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a2f64155e28e1a59b269cb0647b4c133

SHA1
58e82685caf02a20ea9973269b8e173f26318771

SHA256
527237ec2c41913aeb04fc127aca9380c147a31ee2539ae5c598527e60cbde53

SHA512
dc540df6ae6d29c1c9de8de487da4c16504b57f3cde7e2d4d8dee004c2789a134dffb7becbc719d93a28c2ad4691b8ceff98f6d6c1d0f12393d0da4077b9c806

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
81c28d64304ea172339e8efb8c5226ba

SHA1
c2c2a36a56b7c88884871dfe4e5a8d86f339dbf1

SHA256
ad1bca569eaa66e4c71dd7fb83a99af91dc698dd58d4fba3eac178b1329f0658

SHA512
516f320313b0a268b7269df27dbeca5a0130851fe10631811842211dbd3267a2a9ff4346470bef5dc86520da9426571edda78179d1291700b320abf323cd87bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
ecc45f163dec1df93cdfda6583be4c52

SHA1
8264d16630b15ecaf6aaa6ec3fb9f508e1f96148

SHA256
df33b67a8fa122e26e334dbaeddb810ff0d5a56944643761a9015a9bf2dd7c69

SHA512
77e0b0f38185c4b15a0c6ebcebf361f73b204445b2bf230fbf10b5e0387058b156e5da2170443770dd766ddd8766f588dabe3fdb2da58ed411d8ba1f10b27a02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
259KB

MD5
8ea30cba6b0cce017766cc8af1ca361c

SHA1
4f9fde659777757ea6b9e004b2beb9c64bb2efa4

SHA256
8320451ed7b23cdc694464cd5223cb92ed18da7c6bdb47ce26c394133f2b1065

SHA512
6b86db8526610a4ffca82489eccca2ee137d63bfa3e570a2f8f699f1f5f554243f1e19ad5b27cc6edfe0c423af3358f0af4ef93615c6ffb7a6fbfba52af7ecaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
259KB

MD5
ea51b6d87cd2beef33dbd1044cedbc8a

SHA1
e08bf5f0461f93dd4be88684294b9c08e7180997

SHA256
38c3fd4cb861438608009c0a65d14e34fae0d367b84f02d9dc32c7f2f793936a

SHA512
afac5d6f13c65f601d4b3c397db6e16bcc603eb2a4d27593bf5b514e465182ac118ad6abb4e6573445eb7fd4d3109a2fd130a7274a896ca73ed9cc4ac9e7ce49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
259KB

MD5
447a7b7c31af8025cc69f77802f4b85a

SHA1
4c80a44b92e1f88cb9b4a5ac730a197d92dd6e45

SHA256
02fdb2a8b209249bb980ac796c06e505e7ce1aadfb6ac63886c8dd38c87a0434

SHA512
b25314f155dd1e3552be4c6655858fca9be492efbeec135bdf06656d32b4002d0c48d63b270516a6f60e35f377911d52c198d9494f21c65391d242ce94de4906

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
259KB

MD5
d0475fe9df331c3303dc05fc93405d56

SHA1
4388f297ac45fa344b11e93047afb11e90fe77fb

SHA256
e87c60c472e8784e06a911d9e1f9f68bbfcc267a1cb5b6b43c878cad18874980

SHA512
9a31c501f004a35e78a649aea3acaf6fe949cceab59701561ad3c2a0ea67eb1244bcd8cb6b60835c73ddb8463639a62a90f4f223624ed7155e42f9d459e245f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
83KB

MD5
38e75245138134e2ee94751cc64fec28

SHA1
5ed09dc04f8a49130e2faedf574f2dba53949293

SHA256
50aa05998af28fb7b07978305d73496963340a16e81f2a8c099683b5427dfba5

SHA512
662462cf77bfb569e2609e3010d2664c4c7967dd94fe65ba37a267c6549c0e3f1f32dafba2a052c4b10cdcc630d661491cb297a89293045cf7b98fca8096b6cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
93KB

MD5
77c8467647bd1eee551556aab7dbd5b5

SHA1
98fae3eaaa7016eac7582ea43369f941b32aece2

SHA256
93520e16d2d609f6fa504250db032c7d54d0eb32457f8b905924adf4000dbdc7

SHA512
cd25caaefff54475fa1139d405a81eff3f592f175e96afcb36e7db84205fbd7da398516c2fcd3e5d5975309408869c2f9850162237234a14613ade4466004c87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
88KB

MD5
4492d98d9d8987de72d96fb15721e20d

SHA1
1cc4b27fe77a02e4db39bb1463360043477059f1

SHA256
784836e8dd1ef5337fc784b89f1d7c6e905b3a299badc36ccb16e657dfd7015e

SHA512
3a88c2fb87e0c49b8873ac7ce91dfda736bca14bba92bf7ed27d5d803397b7ebfa63dab2bff961f726bc038a41a3124c78b832d4c1090e017924e383d40228e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59678a.TMP

Filesize
82KB

MD5
81c15721501ae437a752214900a8db7a

SHA1
64072a90c7c196c9bd6f3aee3516f21bee226e66

SHA256
e14d74ea567b94a3404342b135ed210ec9377392114ce760b4e9ea4761d1f63e

SHA512
f971ca488ad3760328d5a31d495647ce625f6f9177d6ff753fd3cfe6cf6c1ceb76397f4068ab4ed65fa5fe634733b5f3790a20df89ed8e948bd75af490ebe78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lfs2dbsi.ci5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh20D9.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh20D9.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh20D9.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh20D9.tmp\ioSpecial.ini

Filesize
1KB

MD5
9f5edc0f8aa61ac7fb85bcd8819ee4fd

SHA1
024e470a16925c1f617d60155043bf9be90d92db

SHA256
3cf82cd77349811eb83ce705ffb0dd7ec853c305860a3137f747afdba9187157

SHA512
cef84b82e452b02a3121f55696571f679044f2d6d95ba056eddb123f47ab9b59fb3cd0f97af8a13f5662b02554e12c50519693f5857063cf79cffa49c081d4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh20D9.tmp\ioSpecial.ini

Filesize
1KB

MD5
b70ac30a14f7a14c0f9ecc360ae7434f

SHA1
d3361516217c83ce972e59383813ffb3835b5a55

SHA256
4ad6c2f64ce21f4d20e01f56f9193b0dfdbfa5895676cced1ca8cf766488e62d

SHA512
0c76c3ea0daa5de0077947682757b5102331b8ff44fcc8a6dc2c8c53e4106c7d2a6ab3037578325bea6d8b8a354595889c6184d9259cd34de968249d5143c7f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh20D9.tmp\ioSpecial.ini

Filesize
1KB

MD5
907d3e07a90e24b1f8552f3696534194

SHA1
2b36935fb346babe1273c572c52ece428d0788d1

SHA256
7081facbc742497520c4bfe9573447e50f4c03b1c3eec7a57a98f34c23b629c6

SHA512
bd05c729a54da0f4d123dd033cc7b3c702b333bdb7d8e561e0abc6d1d94ce4cab2a2fca36fdfac2ae7a68b30dee99ed51ff1dae89410329dbd7084815e4f54a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh20D9.tmp\ioSpecial.ini

Filesize
1KB

MD5
4da64a752a305f74a5d8889ffcbc74f5

SHA1
4fdf2811e5241561b509f3c3bb944b92f6248362

SHA256
d47881f41abd1ddd0f2c13ca6fc1bc95338f295aaa7728b2239679e3dadc09d7

SHA512
d823a5b7d898497818c487205904303b909a2da4644c22b91d7e61444de79b27cc3bdc90453547dcd339e4bb476eec24f99afe919b587834d097470a886f4c11

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 365820.crdownload

Filesize
143KB

MD5
15bb6b00a44a4c42c006749dd5730877

SHA1
2237ec7487b481248f0873fa602df4ddd9b3ddff

SHA256
c1b51024712846cef4b2adecec4b3e50c623e20c69fad6b1a00335187cc5530a

SHA512
fb45123c6a85842f7dd30333059d253966f1d81c86993456ef9ed9aa0007e840721bc7a9d9137c9bd1efe3e452e060d6955fd3695a7d8e6fde8c7bc5167b1277

Download Submit
C:\Users\Admin\Downloads\Vorion App Setup.exe

Filesize
47.3MB

MD5
cab622641242a6f2fcbb8a1ae2698fd2

SHA1
9d56b54643706787c16f0cae4e9e565c1e1a49ec

SHA256
f3176e0859ba92049dcd57685c1b5f49b97183ff49fcc79f2ce4ad2b31d2d843

SHA512
324ad8a7669d15ef19d0c1d7b362d17f2118414b4e8672921fe45994db0425200a38e26fc4c169ecb19f7c4aa8233fc5dfd32c3cb32e600cc031139d0e530cf1

Download Submit
C:\Users\Admin\Downloads\Vorion App Setup.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\??\pipe\crashpad_3000_MUUXQUWYITHWPDMB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/908-1622-0x0000000075150000-0x00000000752CD000-memory.dmp

Filesize
1.5MB

Download
memory/908-1621-0x00007FFCD96C0000-0x00007FFCD98C9000-memory.dmp

Filesize
2.0MB

Download
memory/1616-1649-0x00000000760D0000-0x0000000076322000-memory.dmp

Filesize
2.3MB

Download
memory/1616-1646-0x0000000002B80000-0x0000000002F80000-memory.dmp

Filesize
4.0MB

Download
memory/1616-1643-0x0000000000E50000-0x0000000000E59000-memory.dmp

Filesize
36KB

Download
memory/1616-1647-0x00007FFCD96C0000-0x00007FFCD98C9000-memory.dmp

Filesize
2.0MB

Download
memory/2196-1619-0x0000000075150000-0x00000000752CD000-memory.dmp

Filesize
1.5MB

Download
memory/2196-1607-0x00007FFCD96C0000-0x00007FFCD98C9000-memory.dmp

Filesize
2.0MB

Download
memory/2196-1606-0x0000000075150000-0x00000000752CD000-memory.dmp

Filesize
1.5MB

Download
memory/2452-1594-0x0000000075150000-0x00000000752CD000-memory.dmp

Filesize
1.5MB

Download
memory/2452-1595-0x00007FFCD96C0000-0x00007FFCD98C9000-memory.dmp

Filesize
2.0MB

Download
memory/3492-1617-0x0000000075150000-0x00000000752CD000-memory.dmp

Filesize
1.5MB

Download
memory/3492-1576-0x0000000075150000-0x00000000752CD000-memory.dmp

Filesize
1.5MB

Download
memory/3492-1573-0x0000000075150000-0x00000000752CD000-memory.dmp

Filesize
1.5MB

Download
memory/3492-1572-0x0000000000C70000-0x0000000001217000-memory.dmp

Filesize
5.7MB

Download
memory/3492-1574-0x00007FFCD96C0000-0x00007FFCD98C9000-memory.dmp

Filesize
2.0MB

Download
memory/3772-1449-0x00000266D41F0000-0x00000266D4212000-memory.dmp

Filesize
136KB

Download
memory/3788-1504-0x0000000075680000-0x00000000757FD000-memory.dmp

Filesize
1.5MB

Download
memory/3788-1503-0x00007FFCD96C0000-0x00007FFCD98C9000-memory.dmp

Filesize
2.0MB

Download
memory/3992-1638-0x0000000004030000-0x0000000004430000-memory.dmp

Filesize
4.0MB

Download
memory/3992-1637-0x0000000000260000-0x00000000002CF000-memory.dmp

Filesize
444KB

Download
memory/3992-1642-0x00000000760D0000-0x0000000076322000-memory.dmp

Filesize
2.3MB

Download
memory/3992-1639-0x0000000004030000-0x0000000004430000-memory.dmp

Filesize
4.0MB

Download
memory/3992-1624-0x0000000000260000-0x00000000002CF000-memory.dmp

Filesize
444KB

Download
memory/3992-1625-0x00007FFCD96C0000-0x00007FFCD98C9000-memory.dmp

Filesize
2.0MB

Download
memory/3992-1626-0x0000000000260000-0x00000000002CF000-memory.dmp

Filesize
444KB

Download
memory/4636-1506-0x0000000000A00000-0x0000000000C3D000-memory.dmp

Filesize
2.2MB

Download
memory/4636-1511-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4636-1507-0x00007FFCD96C0000-0x00007FFCD98C9000-memory.dmp

Filesize
2.0MB

Download
memory/4636-1508-0x0000000000A00000-0x0000000000C3D000-memory.dmp

Filesize
2.2MB

Download
memory/4636-1570-0x0000000000A00000-0x0000000000C3D000-memory.dmp

Filesize
2.2MB

Download
memory/4940-1492-0x00007FFCB33B0000-0x00007FFCB352A000-memory.dmp

Filesize
1.5MB

Download
memory/4940-1491-0x00007FFCB33B0000-0x00007FFCB352A000-memory.dmp

Filesize
1.5MB

Download
memory/4940-1490-0x00007FF6DB220000-0x00007FF6DB3C7000-memory.dmp

Filesize
1.7MB

Download