hijackloader | df605aa20e6a2d09ceefd7db62e7ff24c6495007f5dc2a453e66a6dc8090b1d7

Analysis

max time kernel
149s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
25/10/2025, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
installer.msi
Size 2.6MB
Sample251025-sfclpsew7c
SHA256 df605aa20e6a2d09ceefd7db62e7ff24c6495007f5dc2a453e66a6dc8090b1d7
MD5 1e6c20b81eec31ef9abf8838b6c055a4
SHA1 44be6cac388692cc057bf3ae9c3ed5512b002595
SHA512 e1f60b9788cb7e3565c02ee5c7b594cb4bee72bdf0c99a531f5b923df29cd2ffbe383da399a535c3878483cbfc2a943bc5584a16fe89d2a565e62befdd01aed0
SSDEEP 49152:zpPqHgHhehWast/vY32cUiMTajH7RP3brTuZ1Dl+lRvxKm:zq2hJ+32UMOXR/b3urh+lZxf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

credential_access discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\portprotocol
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b197-29.dat	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Hijackloader family
hijackloader
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3652 set thread context of 2624	3652	Vector-Sys.exe	86
PID 3652 set thread context of 2444	3652	Vector-Sys.exe	87
PID 2624 set thread context of 3640	2624	GRouter64.exe	89
PID 2624 set thread context of 3704	2624	GRouter64.exe	108

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57c0c2.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7A4EA80E238ACCEB.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Installer\e57c0c0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0EED176E-172B-4FF4-B7B3-F5986C81BC50}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC17B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2D618D3410E5F40F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57c0c0.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFED406533EA640E61.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF83CA3086D770A28A.TMP	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4988	Vector-Sys.exe
3652	Vector-Sys.exe

Loads dropped DLL 6 IoCs

pid	Process
4988	Vector-Sys.exe
4988	Vector-Sys.exe
3652	Vector-Sys.exe
3652	Vector-Sys.exe
2624	GRouter64.exe
2444	Chime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4044	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GRouter64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chime.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007651c20104242b6c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007651c2010000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809007651c201000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7651c201000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007651c20100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134058782744637067"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-954806191-3584048385-2656851463-1000\{1643713E-8DD7-4A9A-90AD-C52EC33C9956}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2624	GRouter64.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
3712	msiexec.exe
3712	msiexec.exe
4988	Vector-Sys.exe
3652	Vector-Sys.exe
3652	Vector-Sys.exe
3652	Vector-Sys.exe
3652	Vector-Sys.exe
2624	GRouter64.exe
2624	GRouter64.exe
2444	Chime.exe
2444	Chime.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
3640	chrome.exe
3640	chrome.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe
2624	GRouter64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2624	GRouter64.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3652	Vector-Sys.exe
3652	Vector-Sys.exe
2624	GRouter64.exe
2624	GRouter64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4044	msiexec.exe
Token: SeSecurityPrivilege	3712	msiexec.exe
Token: SeCreateTokenPrivilege	4044	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4044	msiexec.exe
Token: SeLockMemoryPrivilege	4044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4044	msiexec.exe
Token: SeMachineAccountPrivilege	4044	msiexec.exe
Token: SeTcbPrivilege	4044	msiexec.exe
Token: SeSecurityPrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeLoadDriverPrivilege	4044	msiexec.exe
Token: SeSystemProfilePrivilege	4044	msiexec.exe
Token: SeSystemtimePrivilege	4044	msiexec.exe
Token: SeProfSingleProcessPrivilege	4044	msiexec.exe
Token: SeIncBasePriorityPrivilege	4044	msiexec.exe
Token: SeCreatePagefilePrivilege	4044	msiexec.exe
Token: SeCreatePermanentPrivilege	4044	msiexec.exe
Token: SeBackupPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeShutdownPrivilege	4044	msiexec.exe
Token: SeDebugPrivilege	4044	msiexec.exe
Token: SeAuditPrivilege	4044	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4044	msiexec.exe
Token: SeChangeNotifyPrivilege	4044	msiexec.exe
Token: SeRemoteShutdownPrivilege	4044	msiexec.exe
Token: SeUndockPrivilege	4044	msiexec.exe
Token: SeSyncAgentPrivilege	4044	msiexec.exe
Token: SeEnableDelegationPrivilege	4044	msiexec.exe
Token: SeManageVolumePrivilege	4044	msiexec.exe
Token: SeImpersonatePrivilege	4044	msiexec.exe
Token: SeCreateGlobalPrivilege	4044	msiexec.exe
Token: SeBackupPrivilege	3972	vssvc.exe
Token: SeRestorePrivilege	3972	vssvc.exe
Token: SeAuditPrivilege	3972	vssvc.exe
Token: SeBackupPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe
Token: SeTakeOwnershipPrivilege	3712	msiexec.exe
Token: SeRestorePrivilege	3712	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4044	msiexec.exe
4044	msiexec.exe
3640	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2624	GRouter64.exe
2624	GRouter64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 2368	3712	msiexec.exe	82
PID 3712 wrote to memory of 2368	3712	msiexec.exe	82
PID 3712 wrote to memory of 4988	3712	msiexec.exe	84
PID 3712 wrote to memory of 4988	3712	msiexec.exe	84
PID 4988 wrote to memory of 3652	4988	Vector-Sys.exe	85
PID 4988 wrote to memory of 3652	4988	Vector-Sys.exe	85
PID 3652 wrote to memory of 2624	3652	Vector-Sys.exe	86
PID 3652 wrote to memory of 2624	3652	Vector-Sys.exe	86
PID 3652 wrote to memory of 2624	3652	Vector-Sys.exe	86
PID 3652 wrote to memory of 2624	3652	Vector-Sys.exe	86
PID 3652 wrote to memory of 2624	3652	Vector-Sys.exe	86
PID 3652 wrote to memory of 2444	3652	Vector-Sys.exe	87
PID 3652 wrote to memory of 2444	3652	Vector-Sys.exe	87
PID 3652 wrote to memory of 2444	3652	Vector-Sys.exe	87
PID 3652 wrote to memory of 2444	3652	Vector-Sys.exe	87
PID 2624 wrote to memory of 3640	2624	GRouter64.exe	89
PID 2624 wrote to memory of 3640	2624	GRouter64.exe	89
PID 3640 wrote to memory of 1164	3640	chrome.exe	90
PID 3640 wrote to memory of 1164	3640	chrome.exe	90
PID 2624 wrote to memory of 3640	2624	GRouter64.exe	89
PID 2624 wrote to memory of 3640	2624	GRouter64.exe	89
PID 2624 wrote to memory of 3640	2624	GRouter64.exe	89
PID 2624 wrote to memory of 3640	2624	GRouter64.exe	89
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 3748	3640	chrome.exe	91
PID 3640 wrote to memory of 8	3640	chrome.exe	92
PID 3640 wrote to memory of 8	3640	chrome.exe	92
PID 3640 wrote to memory of 4784	3640	chrome.exe	93
PID 3640 wrote to memory of 4784	3640	chrome.exe	93
PID 3640 wrote to memory of 4784	3640	chrome.exe	93
PID 3640 wrote to memory of 4784	3640	chrome.exe	93
PID 3640 wrote to memory of 4784	3640	chrome.exe	93
PID 3640 wrote to memory of 4784	3640	chrome.exe	93
PID 3640 wrote to memory of 4784	3640	chrome.exe	93
PID 3640 wrote to memory of 4784	3640	chrome.exe	93
PID 3640 wrote to memory of 4784	3640	chrome.exe	93

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\installer.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4044

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2368
- C:\Users\Admin\AppData\Local\Temp\Dishonour\Vector-Sys.exe
  "C:\Users\Admin\AppData\Local\Temp\Dishonour\Vector-Sys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\ProgramData\portprotocol\Vector-Sys.exe
    C:\ProgramData\portprotocol\Vector-Sys.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Users\Admin\AppData\Local\GRouter64.exe
      C:\Users\Admin\AppData\Local\GRouter64.exe
      4⤵
      Suspicious use of SetThreadContext
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless https://google.com
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3640
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd5c9edcf8,0x7ffd5c9edd04,0x7ffd5c9edd10
        6⤵
        
        PID:1164
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1824,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:2
        6⤵
        
        PID:3748
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --field-trial-handle=2196,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
        6⤵
        
        PID:8
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --field-trial-handle=2352,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
        6⤵
        
        PID:4784
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
        6⤵
        
        PID:4808
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
        6⤵
        
        PID:1996
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3676,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:9
        6⤵
        
        PID:4304
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3524,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
        6⤵
        
        PID:2120
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --extension-process --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3548,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:9
        6⤵
        
        PID:1272
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3740,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:9
        6⤵
        
        PID:4764
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3764,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:1
        6⤵
        
        PID:1340
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4304,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
        6⤵
        
        PID:5424
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4428,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
        6⤵
        
        PID:476
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4660,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
        6⤵
        
        PID:1396
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --field-trial-handle=3484,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
        6⤵
        
        PID:2916
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4812,i,6757077291329285102,15665642231580880367,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
        6⤵
        
        PID:5720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless https://google.com
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:3704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3704240667328 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3704240667328\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffd4a3af208,0x7ffd4a3af214,0x7ffd4a3af220
        6⤵
        
        PID:924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=1996,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:11
        6⤵
        
        PID:6012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1944,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
        6⤵
        
        PID:2316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2344,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
        6⤵
        
        PID:6096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3344,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
        6⤵
        
        PID:3548
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3360,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
        6⤵
        
        PID:3120
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3932,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:9
        6⤵
        
        PID:5024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --always-read-main-dll --field-trial-handle=4008,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:1
        6⤵
        
        PID:1520
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3988,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:9
        6⤵
        
        PID:3316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3848,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
        6⤵
        
        PID:1300
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4060,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
        6⤵
        
        PID:976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3828,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
        6⤵
        
        PID:5576
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --always-read-main-dll --field-trial-handle=3844,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:9
        6⤵
        
        PID:1028
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4108,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:9
        6⤵
        
        PID:556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --always-read-main-dll --field-trial-handle=4328,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
        6⤵
        
        PID:760
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --always-read-main-dll --field-trial-handle=4232,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:9
        6⤵
        
        PID:2456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --always-read-main-dll --field-trial-handle=4236,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:9
        6⤵
        
        PID:3324
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --always-read-main-dll --field-trial-handle=4356,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
        6⤵
        
        PID:2244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --always-read-main-dll --field-trial-handle=4420,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
        6⤵
        
        PID:4272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --always-read-main-dll --field-trial-handle=3864,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
        6⤵
        
        PID:4680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --always-read-main-dll --field-trial-handle=4756,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
        6⤵
        
        PID:4068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --always-read-main-dll --field-trial-handle=6264,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
        6⤵
        
        PID:6040
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --always-read-main-dll --field-trial-handle=4940,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
        6⤵
        
        PID:476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --always-read-main-dll --field-trial-handle=6688,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
        6⤵
        
        PID:2092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6280,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
        6⤵
        
        PID:5592
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6320,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
        6⤵
        
        PID:2916
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=3572,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
        6⤵
        
        PID:2768
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=3576,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:14
        6⤵
        
        PID:2224
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=7444,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:14
        6⤵
        
        PID:1932
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=7444,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:14
        6⤵
        
        PID:3456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=7540,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:14
        6⤵
        
        PID:5912
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=7692,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:14
        6⤵
        
        PID:5996
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=7564,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:14
        6⤵
        
        PID:4544
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=7584,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:14
        6⤵
        
        PID:1960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=8064,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:14
        6⤵
        
        PID:1824
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=8232,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:14
        6⤵
        
        PID:4616
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=8404,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:14
        6⤵
        
        PID:5480
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=7636,i,14992751009228693902,7334605522020784152,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:14
        6⤵
        
        PID:3552
  - - C:\Users\Admin\AppData\Roaming\portprotocol\Chime.exe
      C:\Users\Admin\AppData\Roaming\portprotocol\Chime.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2444

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5652

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57c0c1.rbs

Path C:\Config.Msi\e57c0c1.rbs
Size 8KB
SHA256 7d0723aa99b104ea1f2ac2a3af7ac4ae329db956735f0667b66979802ccb08e6
MD5 c0a780bdf9ffee8f4fc9978d5e7402bc
SHA1 f6fe58df32bc1fa8ba8a905595e3b29cb46976eb
SHA512 9707963089d094ab55ae9bec4770c3a3fa0ad02c6db0ce5f508f7a0c348f33dddeaf0bc3f1384f0cc5758d9f65e8399d705c4eef7c6c3465bbe0eab2b5f816ec
SSDEEP 96:CEmOn7WLpWcyDCUd1dDmUQIGFCsThqKUQIGFC6jFXd5daCThqsHpdWqgdr956Fdz:CZZ2DCuZ/G4Ii/G4WxfBKdpQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

GRouter64.exe

Path C:\Users\Admin\AppData\Local\GRouter64.exe
Size 173KB
SHA256 de9d09f0e26cb4541f5d6788aee22183c6a380a1460f0955171316bbcac5dcb7
MD5 5e6c05d3f8a06f263e1d53fc5c2c53b2
SHA1 d957050dfc3aed8f22d9ace3a5d22192f8527513
SHA512 f3d7f18695dfc24c554443970dedd6ae366dee901241a3ec17fa85f1d00e4459a11802e40e263a4a078974b92652ef2897d2ad2b7edd9c3a08e9954ad24f597b
SSDEEP 3072:1H50cLgcmLDaSaCBLBB5OsA3ivrQgpEsMAl+5xuKjZo2bIlN5+FzE:1Z0cLgcmLuS9FwplLAX2cp5
MD5 SHA1 SHA512 SSDEEP

Submit Download

15AC5B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\15AC5B1.tmp
Size 2.3MB
SHA256 b1f04a905ad927f4cb9fc184793637004a049489814329d25b272b61c661f619
MD5 a797941192c12b2bd136e95159d711c8
SHA1 e35c1f6df3f44bf9c810665aaf3dcbe7773aea76
SHA512 22427fa9a52a27956544c80c6bbe596351936de71fd16e40abc5f88c4a71692b6fb0380183adf3af58608964b5ebebf9a9e3e91de49fe5ab93fba58439dec9ce
SSDEEP 49152:LO+4uYMAwIi74Yfmifo7H7sAZ+SN+B7VPwhwl1UlLoPn+0D12:LO+bAwIW28BHkwl1Ul8m0DI
MD5 SHA1 SHA512 SSDEEP

Submit Download

15AC5B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\15AC5B1.tmp
Size 2.3MB
SHA256 467867bc8cedab8b63b3a0f77f692b4b87da57b299a333b2b1335846f28f6ba2
MD5 5af13fca29f55aed04b010b8120f3a1a
SHA1 81d842871f31301d5ddceff3726101837aeb1a04
SHA512 bba11abe2247cc1715d0e5627a3d6d082bfcaeccd8405953d93c0b0239cbbc2a3adbafd592d426d88ceb42f184a453c05bb7454891dddee4b20ca8705046f4ba
SSDEEP 49152:LO+4uYMAwIg74Yfmifo7H7sAZ+SN+B7VPwhwl1UlLoPn+0D12:LO+bAwIw28BHkwl1Ul8m0DI
MD5 SHA1 SHA512 SSDEEP

Submit Download

21ea-4cdf-ae5e-41f5.tmp

Path C:\Users\Admin\AppData\Local\Temp\21ea-4cdf-ae5e-41f5.tmp
Size 40KB
SHA256 c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
MD5 dfd4f60adc85fc874327517efed62ff7
SHA1 f97489afb75bfd5ee52892f37383fbc85aa14a69
SHA512 d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4
SSDEEP 96:iLSQCn8MouB6w9f/8iZqmvJKLPeymwil:iLSQG7Iw9fEiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

42AE32E.tmp

Path C:\Users\Admin\AppData\Local\Temp\42AE32E.tmp
Size 40B
SHA256 8732590c5640d9c3699ad7ae7b6b6972ccbe807d69e384f2bef0e76f7b806d4b
MD5 a4398190d9f7c2356cbc2ab86bdeb054
SHA1 34030d26081dbb058dd453a7731720048b413236
SHA512 bfc1daf09737b48e4c14db17c586cbf3f4206979444a3400ab293c1d7bc26d0e85f5214431c4e6c96e70f0cb83294792e8d7416f613452cabd9dcbea8cf554fe
MD5 SHA1 SHA512

Submit Download

8ce9-05c4-1c0e-4d98.tmp

Path C:\Users\Admin\AppData\Local\Temp\8ce9-05c4-1c0e-4d98.tmp
Size 60B
SHA256 799b4781188e327fb75295a8cd371a5e802ea806754703a768c11b30ac530203
MD5 a4db928d924abad43fe2887637408d2d
SHA1 318d9e42f9d19e91a6eb1124f2ab30a8d1ac1885
SHA512 6eb517842fc95b295c8c93d6806bb26a3f45d90fafccd434eee033946d0df65c76183659b302dcc8e48ed0987e1d79fa09946d27838d12356bd78c08e9ba96d8
MD5 SHA1 SHA512

Submit Download

BugSplat64.dll

Path C:\Users\Admin\AppData\Local\Temp\Dishonour\BugSplat64.dll
Size 377KB
SHA256 a9541c91a5f37c3ba4aaf64524ed3858d7d2c77a6cfd5e9ac7ea7945a785ca22
MD5 2774d76b94c6c3f6c7107f2db93cb83d
SHA1 c20e2925f84f89e8a6df611a7179d3dae9e45ee5
SHA512 acf9d1615f81373c6ef86d4b4d2bb52baeefae7ecc7be8189a561c78526418308e2264b970336adcfc714f999c0f49b51594c9a1bbe922d1e9f43891d07ccb15
SSDEEP 6144:MpPHwDQxTcl7DyzWPZVEsTRGRXvRyZK4rtx9TYo6JqXJrhCs7tz:MQQw7xPZ9zr5Ynkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shug.qk

Path C:\Users\Admin\AppData\Local\Temp\Dishonour\Shug.qk
Size 17KB
SHA256 1adae441501d2e64255e280adcbf389794c9742a3a74a612318ba9a201fa43d4
MD5 cebea88c45ed4ec1654c4f7d293ef00d
SHA1 da910f6003e6793084da8a85f5db7f40f8277b4a
SHA512 f16c021c2d04ede4dd94c16a9d999cad4dd14ec4db109eab0ba0b79b7ba988fcd2e34b21d7a9e16cae5f9f355cba42cd47906097977917fa4039c217525307f2
SSDEEP 384:l8+z36yxguQ1Us4iw0w1ZqfboFzeM8rVbjyU5/qJ9TbhHG:++r6yi1f4i4ZqfboFznIb2UFqbbhHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vaekveedplees.odj

Path C:\Users\Admin\AppData\Local\Temp\Dishonour\Vaekveedplees.odj
Size 2.1MB
SHA256 9b16b0f2bc74baab67d5322a3f0d619c4c62248b14400ef0878b2743661bcef1
MD5 143f7fc5ed6da262b7fe0ce2ee15b900
SHA1 724cbc3fc6096bed4b521c442105ab07b93c485f
SHA512 32c807973734a614025942c538e2218a66fb2ea5dc5d03d4dea7204ffabce77b612c5a05993e590200eabcc8286d9f8981b879d39ae8eef5f9775750ba2e2389
SSDEEP 49152:0C6qeHn3/tKg1CFltYVyb79JKGqiXTRjH0qPhb9WjZno:0qk3/tgYe9JKcXFIq5bcj5o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vector-Sys.exe

Path C:\Users\Admin\AppData\Local\Temp\Dishonour\Vector-Sys.exe
Size 270KB
SHA256 fdbe7dbe0228baad747bf7e8d830cbfbed7d2bd3013b8080dc50e726b21ddac6
MD5 6a06b58d738d47e93f08ff39112fba2c
SHA1 3d4cbc2bf0362c3a7af191b69e310589d86bc1fb
SHA512 e021f725e01cb5018ec05c06f54d95b24758d137b80cbde52217bb85e2d809204f5afb90e9d57117b48135003cb7d7ba3773eb6b23dcde2bae246bd208e4f7ea
SSDEEP 6144:VIaCAK/UGjgTPD/CRe4GvTS8w9hzc9ap+zGd:qz7KmH9tpT
MD5 SHA1 SHA512 SSDEEP

Submit Download

libomp.dll

Path C:\Users\Admin\AppData\Local\Temp\Dishonour\libomp.dll
Size 757KB
SHA256 b20a82c7506960d32afb4f0f8cc76e0b027f26e8b34f1f2c0c971a7abf5cf243
MD5 e7fb320a54896c842ee35677bff5f195
SHA1 730fef95be4a43f28956d226cdab432a573496e0
SHA512 949944a103fe3f93d4aea73a503b74ddae4603ece3a591c736ed1b9ff0d366049e76fc16af6dbfd6255c05fe8fbc4f4ad2a8af9242a36992d750da842662a4ee
SSDEEP 12288:hnMmgfyiIhp1icC6WHeyXwvJCaehMt0E7mHAW8Wkk617cq/y:cKPFC7PMJ56HAWrkkQ7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

FJz8.7z

Path C:\Users\Admin\AppData\Local\Temp\FJz8.7z
Size 8KB
SHA256 03f1cff2cc72613413e27d7f44e9a40611f8a855e6097e303f999675d44ed50c
MD5 f5d2cfa001538b9bc87a7b9937cd4688
SHA1 0578e2bf43aa5252edc25995604f8fb11ab0dc7b
SHA512 6512543077be0b9b71626463f9bbfdd34386490b582606fc17b640e042e55d3ef4f23b282757bbe710c1cdca0b75546fe94be9ad47c59a5500229ca6913e2322
SSDEEP 192:tgo24TG3HtmkO8QDpbHDHhugQXZ5a/wPn1g14:tgo2zXgkO8spbHaZ5aQG14
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3640240664562\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3704240667328\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

1537-23fc-d5f6-68d3.tmp

Path C:\Users\Admin\AppData\Local\Temp\hvTrz\5G853Bs0\Default\71eCwT\1537-23fc-d5f6-68d3.tmp
Size 56KB
SHA256 ce41f2a3255df2099ae8eea9364bd28c6fd6a56c8ca3290bd274944d16d9e6bf
MD5 0e2c60740cafa19c5158f4aa41a5d4e7
SHA1 f01d0f359e407fed424c30919ed64b77508b3024
SHA512 e367b88f1d984f84b9b4a8fa4002ede1afad0d375f9374636250f17e64445a60d1b99fe23a0b314c4b2bd5fd27fe5b87fa4079a84b4497629f238afd8436afe2
SSDEEP 96:qUfXG38t8KLPeymORCGr25bn8MouB6w9f/rGSEPONy:qUu0RCGr2V7Iw9fFN
MD5 SHA1 SHA512 SSDEEP

Submit Download

9e5f-b61b-29dc-92dc.tmp

Path C:\Users\Admin\AppData\Local\Temp\hvTrz\5G853Bs0\Default\hkhUpa5eS4\9e5f-b61b-29dc-92dc.tmp
Size 20KB
SHA256 6fd02145a40bc8042392e6d5b982213d131724d8a7f2a85e341609adae0e9635
MD5 a6cb29a3e4531f1259bf6c8bd226db19
SHA1 b74878ba845d3e17c95f215b77ab4d8483a74a12
SHA512 c6f79ad1ae9b710e013e20e33729e3ced5bc7b7edb377319e97dbf6e52fa7be4c13e258512d9e572270b454fe88b7f8fbfcf98d07c7ab037bc3b9087fd9d7219
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfBLaJm3MleZWYw4VIm/:T9LopFMatSaw/auUOt8BLaJmsYw4VIm/
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5f8-f354-85c3-a2d1.tmp

Path C:\Users\Admin\AppData\Local\Temp\hvTrz\xwyFv0\Default\hkhUpa5eS4\f5f8-f354-85c3-a2d1.tmp
Size 20KB
SHA256 d696292d20af2ef8d7ea106e549283d0a2cd1f6bcec51637b077954bff09cbd7
MD5 ee190635ad76856bb8e30153f03b5e67
SHA1 99be92cf8d170ca9b5d4312d8cddf12005356544
SHA512 b2a524a0fa1c0e9e93f0bd2f20d96233cc3fdfd04bd078725a136d605dfd58670b7910e352e56dd53be20dcac0bac04dd3ec58127351de964134328ed543e6a8
SSDEEP 48:Tem9aw/aHLopFMavU1iB2Hn3/oisODHWO:XPareMaZmnj
MD5 SHA1 SHA512 SSDEEP

Submit Download

y5Xf56LKB

Path C:\Users\Admin\AppData\Local\Temp\y5Xf56LKB
Size 32B
SHA256 8813e39375c366f7eb42ae50ba36a1dfd83e92e1c0031b4b31662ca64d4a4947
MD5 816aae198c8d00c5d9b807939e04bfeb
SHA1 b6041dd2aaf528ecf36efeb1b842fbbc3104b08f
SHA512 ff216b00c4d3ed8046371ebb1640803f07d305b648e6552441e4ea00d26a5687c8740ee67e549720a1c7b6d1f44785052c1130af457277d5e2802ccaed71b85f
MD5 SHA1 SHA512

Submit Download

Chime.exe

Path C:\Users\Admin\AppData\Roaming\portprotocol\Chime.exe
Size 619KB
SHA256 adb8347dfa1b1df1ca2211fe4d7e82f27ced939f1bf3d52548e52bc9e23fc52c
MD5 dd65b976d1865ba6c2368fcf9c9eb223
SHA1 db933b1ff0dc73c2e4f230aa3bd47646632d5714
SHA512 5ff91cc29744416a32789f277f2494bbe60bd1f2eb53ea48e538075e8d735420c0256b7798e8f99b9286bf8c3b0dcf5f1a1539b8f2792991fb7d5754ec6fa0df
SSDEEP 6144:+Zzvhs2Z4n1E7g34XtVYAOfTdH8zjQSYoLdnU4q:+J+2Z4nShVY5CjQxoLdnU4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

e57c0c0.msi

Path C:\Windows\Installer\e57c0c0.msi
Size 2.6MB
SHA256 df605aa20e6a2d09ceefd7db62e7ff24c6495007f5dc2a453e66a6dc8090b1d7
MD5 1e6c20b81eec31ef9abf8838b6c055a4
SHA1 44be6cac388692cc057bf3ae9c3ed5512b002595
SHA512 e1f60b9788cb7e3565c02ee5c7b594cb4bee72bdf0c99a531f5b923df29cd2ffbe383da399a535c3878483cbfc2a943bc5584a16fe89d2a565e62befdd01aed0
SSDEEP 49152:zpPqHgHhehWast/vY32cUiMTajH7RP3brTuZ1Dl+lRvxKm:zq2hJ+32UMOXR/b3urh+lZxf
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 1d5d0bbbd96c400ee71a3d82ca22f5cc8271a426e07c286ee541d3371f96c306
MD5 098215caddcf217783d79e8bf8db3eec
SHA1 3c291a22551f1c008012105bc07e587dfeab31bc
SHA512 76061869d3b996a500d918a16de7fbcd6a457ffecefe02c2a4801c99eb16ccb88c9b3ca1d6b89eab3dd3a81c2f4a5fe0a0db2c22bf6eec74b6d46906b3d185d1
SSDEEP 24576:zZ1mSptMdoO/vvTLQGbeRUX6/6FPQ4fB22YtXJk7ig64kXfCoga27bxcX:0
MD5 SHA1 SHA512 SSDEEP

Submit Download

{c1b115be-2e4c-43ef-adff-14260162ba57}_OnDiskSnapshotProp

Path \??\Volume{01c25176-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c1b115be-2e4c-43ef-adff-14260162ba57}_OnDiskSnapshotProp
Size 6KB
SHA256 24576abd5c09982d3ae8401a3401c7cbfdcda87ebc4efddb5bec4dc5ab46b189
MD5 e2f91d36fb37ba79c9c8c350cd6bbdf9
SHA1 68937df0fb1cb9306457e3fabc75d5fe5844f20f
SHA512 d7835610cbd1528e19e7865822b04b7a24dc89a3c46754c169c21620924fd0d6e07896361643adcfc94b0a5480a2ad49a427d50f053154f3a10787e69c551641
SSDEEP 96:FZa4NjMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:K31b++ZVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2444-71-0x00007FFD7DBC0000-0x00007FFD7DDC9000-memory.dmp

Download

memory/2624-259-0x0000000001230000-0x00000000015AB000-memory.dmp

Download

memory/2624-62-0x0000000001230000-0x00000000015AB000-memory.dmp

Download

memory/2624-60-0x00007FFD7DBC0000-0x00007FFD7DDC9000-memory.dmp

Download

memory/2624-55-0x0000000001230000-0x00000000015AB000-memory.dmp

Download

memory/2624-68-0x0000000001230000-0x00000000015AB000-memory.dmp

Download

memory/2624-73-0x0000000001230000-0x00000000015AB000-memory.dmp

Download

memory/2624-321-0x0000000001230000-0x00000000015AB000-memory.dmp

Download

memory/2624-322-0x0000000001230000-0x00000000015AB000-memory.dmp

Download

memory/2624-331-0x0000000001230000-0x00000000015AB000-memory.dmp

Download

memory/3652-53-0x00007FFD6DEF0000-0x00007FFD6DFFA000-memory.dmp

Download

memory/3652-47-0x00007FFD6DEF0000-0x00007FFD6DFFA000-memory.dmp

Download

memory/3652-45-0x00007FFD6DEF0000-0x00007FFD6DFFA000-memory.dmp

Download

memory/4988-30-0x00007FFD6DEF0000-0x00007FFD6DFFA000-memory.dmp

Download