902584a04274d0cfbb766ace6f0b52d90d4b43bd0c6bda89ca5a6547662f02b2

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
233s
max time network
233s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vexor-updater.exe
Size 2.4MB
Sample260702-v72q1sf14p
SHA256 902584a04274d0cfbb766ace6f0b52d90d4b43bd0c6bda89ca5a6547662f02b2
MD5 468d4be3b71eea444c233ea682ea2f29
SHA1 21559b0d04719811d35d2482c0b455b8540e581e
SHA512 5422b79836480232ce96f2be8022e5149e1bf1382c7c86ab26812953de41f821753f042606443348a1d7ef6ce4fd8257c0ff9b6d1ecff5b1018791ede7e2d168
SSDEEP 49152:HoaFRu674+P2Jn2fpJ+79akz2UsnE73nowWx2mk9GDBWASp:nDJU9Tsnzc14Dm
TLSH
T1F7C5CF4552A916ECC176E178D706A617FA3A34840B309AFB1BE14A162F63BF3577F320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	vexor-updater.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	vexor-updater.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	vexor-updater.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
112	3068	chrome.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	vexor-updater.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	vexor-updater.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	vexor-updater.exe

Executes dropped EXE 2 IoCs

pid	Process
5040	vexor-updater.exe
3228	vexor-updater.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3364	vexor-updater.exe
3364	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3068	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274876652034949"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3364	vexor-updater.exe
3364	vexor-updater.exe
3364	vexor-updater.exe
3364	vexor-updater.exe
3364	vexor-updater.exe
3364	vexor-updater.exe
3364	vexor-updater.exe
3364	vexor-updater.exe
3364	vexor-updater.exe
3364	vexor-updater.exe
3364	vexor-updater.exe
3364	vexor-updater.exe
3364	vexor-updater.exe
3364	vexor-updater.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
5040	vexor-updater.exe
1764	chrome.exe
1764	chrome.exe
3228	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe
3228	vexor-updater.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3364	vexor-updater.exe
5040	vexor-updater.exe
3228	vexor-updater.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 3716	4928	chrome.exe	103
PID 4928 wrote to memory of 3068	4928	chrome.exe	104
PID 4928 wrote to memory of 444	4928	chrome.exe	105
PID 4928 wrote to memory of 444	4928	chrome.exe	105
PID 4928 wrote to memory of 4736	4928	chrome.exe	107
PID 4928 wrote to memory of 4736	4928	chrome.exe	107
PID 4928 wrote to memory of 2240	4928	chrome.exe	108
PID 4928 wrote to memory of 3424	4928	chrome.exe	109
PID 4928 wrote to memory of 2240	4928	chrome.exe	108
PID 4928 wrote to memory of 3424	4928	chrome.exe	109
PID 4928 wrote to memory of 1528	4928	chrome.exe	110
PID 4928 wrote to memory of 1528	4928	chrome.exe	110
PID 4928 wrote to memory of 2936	4928	chrome.exe	111
PID 4928 wrote to memory of 2936	4928	chrome.exe	111
PID 4928 wrote to memory of 1424	4928	chrome.exe	112
PID 4928 wrote to memory of 1424	4928	chrome.exe	112
PID 4928 wrote to memory of 1520	4928	chrome.exe	113
PID 4928 wrote to memory of 1520	4928	chrome.exe	113
PID 4928 wrote to memory of 420	4928	chrome.exe	114
PID 4928 wrote to memory of 4952	4928	chrome.exe	117
PID 4928 wrote to memory of 4952	4928	chrome.exe	117
PID 4928 wrote to memory of 176	4928	chrome.exe	118
PID 4928 wrote to memory of 176	4928	chrome.exe	118
PID 4928 wrote to memory of 4720	4928	chrome.exe	119
PID 4928 wrote to memory of 4280	4928	chrome.exe	120
PID 4928 wrote to memory of 4212	4928	chrome.exe	121
PID 4928 wrote to memory of 1592	4928	chrome.exe	122
PID 4928 wrote to memory of 5040	4928	chrome.exe	123
PID 4928 wrote to memory of 1764	4928	chrome.exe	127

C:\Users\Admin\AppData\Local\Temp\vexor-updater.exe
"C:\Users\Admin\AppData\Local\Temp\vexor-updater.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3364

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff415bc728,0x7fff415bc734,0x7fff415bc740
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,14582531322701273818,9394114442164064031,524288 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,1681319595848656753,7241939623932315781,262144 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,2312531439804785888,15227646493962290583,524288 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,4978669251839057771,3780044572856464446,2097152 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,3114009278418607852,8947006245535361713,2097152 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,6573168324539331124,14133122572400567907,2097152 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4784,i,14429977686066146621,11438659174023552789,2097152 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4932,i,6389920153711826506,16946830586960468884,524288 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5108,i,186012260767524215,13326189119543991329,524288 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,13660242716650936373,6700968350031974894,524288 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5776,i,8143247847571479088,9585316664747034966,2097152 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4796,i,5018048643122228848,3745885153092535897,2097152 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,8161056382502737402,610367187190581993,524288 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3684,i,2670973505798194083,3923966200207130229,524288 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3704,i,8086494670653117849,1496993473429000369,524288 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,15399049177491254146,4614167446091851881,524288 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:1592
- C:\Users\Admin\Downloads\vexor-updater.exe
  "C:\Users\Admin\Downloads\vexor-updater.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3304,i,8256977874550498662,2824638011492079725,262144 --field-trial-handle=1980,i,13399868700133054699,17764252273210912504,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2040

C:\Users\Admin\Downloads\vexor-updater.exe
"C:\Users\Admin\Downloads\vexor-updater.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
Size 2KB
SHA256 e3c6cf61fde02a5429aa8a530550425b098725bcee4528a19dbb360caac4888d
MD5 03ac38d1e300501568cadfe8259f8178
SHA1 3389dabd1359c2221a315abc4aa6465acde3a7c9
SHA512 77dffb84464bc8db3c108b62a87edc9f552122f884f66a62caff47ef7cf9fa6d635401d42dcb7d8198bcba8db6dfc391e95f81d89f80510ee64c4c5005b1c403
TLSH
T13B4129E3CC182030C90A06373FE0D9736F55E4C01CC2F06794CDA5624D8EFEA6A0940D
MD5 SHA1 SHA512 TLSH

Submit Download

A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
Size 727B
SHA256 2cfe67a8eda91051358088c9cfe60f17ea4fddc9545405adfafdc8262854d045
MD5 365285808bb69c7a5c0c932fc0e3e1df
SHA1 2c0972a76dceb1ff5e4b13e316bcd711a7df7f63
SHA512 161f41fd1cbd23b1f2211142b777fe3d20e831791a5ee2f5951215f904a7a33da1b7f4c5958add82d18f412d42c93b3a7d024c2e6540f709b91dc0ba6ba311cd
TLSH
T17B0110F6666D80C1FF2B053340E1A4BC25E872BC64E6054A6CB868852C0ABAA36D70A5
MD5 SHA1 SHA512 TLSH

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
Size 484B
SHA256 c0149a3c5947135b6ba7149fdd22aea84ef2aba987b60e2d6b05ced5dfb1e620
MD5 976de8c3008ed24b01a38b7986bd711e
SHA1 046947981be95a8a15b4c521b1c80eab52657aa1
SHA512 eeef84dbaf0778f90a0d5ca180c2bf85173116af27acd35895710016dc6677d36f682da092bb3fd650400723f783e4a64e2b7e3908b5b6c21db3be6e07f62349
TLSH
T18EF02B2C35EF011DF0BBDC788AA999A1BE29F1232C050EA90F9935496D42F05DEB365D
MD5 SHA1 SHA512 TLSH

Submit Download

A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
Size 484B
SHA256 6dd0fcbb6b590f022b423d6530f7db42a12db24ee5f45ce24f6b0790c6b382b8
MD5 78a4e50fbfe9156e4bb362ac5844dbff
SHA1 02a26671994c9f3b34900264d4a01185d1ee3150
SHA512 e87c186cfc53afe198e212a835a8dd40d9fd095febba48b130b1abed2c78b341ff33d568513d8047325b666f0d58d9e98cc1d0ddf54001c4f3c9937a6732d1cb
TLSH
T1D4F0A33C11EC410AE1FAD8BC5FE8B5559D2DF316240015F451516495A911F40AF72136
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7b74587f92eab7bfa90c4c148d9bf0b610d8080f54532aa9a560865d96af12d8
MD5 c13572990818d6eafd4accaa3d37847d
SHA1 2f411329c7d51df6b5825bb0f7ae2e429f0426c6
SHA512 158084e8e72c28af1b5ddd2a8646c5abbfe7f76e21fdf590370e5fad97ad0ebcd04594655e2985373be53372508ef13e75de59caa7589b0785d968f91760fd84
TLSH
T115E02BAAC8219C272DF95B2820544646E74003573F90C80F3B3E83088FB5A3B4567C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 cba61269a7fed43aac15afcda237d151aafd7544a7b8b0c598557f1216153d40
MD5 63d4133da3b34ff98400137f8c840383
SHA1 7885e491fddbda03f49b1f7521d0cdc88ea67e0c
SHA512 75f946c50ff566cc7087d5d9edbab3685ca94b76405ac4b6ff96365346708ccf0252d996471db5909fd7ebc0b2b6dd74a9337039d954845c0b4cc52a5c46b46c
TLSH
T1BAB022B0BB83008BCBB803F02EE2028C30B2CFCA0203022280C802BC80303F2B000C22
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d3ea0634f9389b8ea09028814d9f03435f7b6a6dfa676b4dadb775896fe1cf0d
MD5 60730973a2efa22051ba50631eb89ecf
SHA1 cc43771a4c7bd5bbafa9d77e09aa0b44ec050f46
SHA512 50022cf0b39212e5a68db60479944960f3fdf397d1aadb51c56b073d469e25ae9261e0a6fdb63895121becb716bb139efe5a3e950e921b2aacd31ff56d2950bb
TLSH
T12E4148F3C7D8897D890156F8A7192F2FCE790E14536C3C5A89E5AE0B53E1872E24058F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 a9511145ebbb3a19f227aa414a186685b4c42890bf92e292f6f6fbdb9e1fdccb
MD5 01b5fd71eeb28fc247bb392d9666b4a8
SHA1 c31772c942d58be8e141030dfead8dee49e66030
SHA512 0a8d94507c1669d9f73d014d7d8371ef6a1be8c3f770d89ca54cd33b76775ec73c5cb0235e10dc6e4dd1aca4ebc39c44c47d5c18205a08eef8061335b69362bf
SSDEEP 48:YALlqWqWNFhLUN3zaXYfoKsfKgmzsfX4sfMfsf6osfaKsDMsB+sS4zspRs2UMsom:DBzTepaImKOXfMI6PaNFgfhUUUG4
TLSH
T14E919CF7C3E98A6D881162F4BB246E1FCE690918431C3D66C9E4AE4B63E25B1D31135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 35d4ca4fb138c0a43d9f99076c1f804db869f0cb88dd55043ec5ab09c25b4a1c
MD5 de988b9d5eb18915de47e2f6509653fd
SHA1 4b963622aabd3767b2a9b0a03f764075e41f6f79
SHA512 2a68636a8fec77a978c2b1dc1b147e6b3f336324d6f7d6fdf30099f11587fbfe315ad9bcc8e9d3d54a2e3bfb35a7415d0da7da528197701e0e9874c16c5bc42b
SSDEEP 192:vR9vdDZ+dCpGJfv7cpAPRp2q769BHsb+WNnp29IfO8YRxFe4GSe8ZVyIsnAUgraJ:vR9VO3wUXlerwl1YRlGi/e
TLSH
T1E752C82EA9106A7B6CDBD319FE61BB57E3F2102635842E80E6FC8B1C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ee7311337071fadf788cc6c81caebf29acb9d8548c97439f02f5e5a44c9dfe5d
MD5 3f34dd29bc185c1ac5f33e203e19eaf4
SHA1 b95db67eaceb57ebe961ccb54c86977efd9ecf95
SHA512 e102ebe558cabda1ec7dc15f2c55b10d79f5cfab69a4b53826a971d38e7ddd56b72ad6dca40e134a9511dbbb75f9261475ecacbb3aadc90b5da4bf683246fedf
SSDEEP 192:vR9vdDZ+dCpGvdv7cpAPRp2qg9BHsb+WNnm00UFe4GS5ZVyIsnAUgtaJ:vR9VudwUXlgrwN06GU/8
TLSH
T17542DA2EAE10697B5DDBD219FEA5BB43E7F5102235942E80E6FC8B2C15E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a80cd0af7d3b0142ec2467445e0ae6d0976db0294a68e850d79461736d48cb19
MD5 aa399014709a023298f71d0c3d602378
SHA1 d711c36d267782fee125997ffcd049664c0d5840
SHA512 0a80dcb0166c3ae37ba63d99da11aeb691a1259a15054557ca322ef3304b044eb4446e3b009cab10781dcf144587c4d17e7cc76dc66323677bcac57302242267
SSDEEP 192:vR9vdDZ+dCpGJJv7cpAPRp2q769BHsb+WNnp29IfgmesFe4GSe8ZVyIsnAUgraJ:vR9VOJwUXlerwl5eCGi/e
TLSH
T16E52D82EA9106ABB5DDBD219FE65BB57E7F1102235842E80E6FC8F2C15E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0abef463df2ee01f3d50ea6da26c6d570741a3ca3d9e3a2414bdb649f51cb10e
MD5 b6606870628ac5476f54658408763757
SHA1 0e7dda5c535269456eb52488cbee61c4c3c4b201
SHA512 4c9ce4bbaefb83b3f385bd342b0627359408aa98bb31c504110735450a07e4efe4d4045268839c8010170f3e9bba2a8fded3391b9695f1c9e783a9bdbcd6e288
SSDEEP 192:vR9vdDZ+dCpGJdv7cpAPRp2q769BHsb+WNnp29Ifgm2mFe4GS5ZVyIsnAUgtaJ:vR9VOdwUXlerwl52kGU/8
TLSH
T1B242E92EA9106A7B5CDBD219FE65BB57E7F1102236942E80E6FC8F2C15E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2d8ebc4d24b49786501b4982628abdae8bf7b89a50460ecc76f02ee83b90814a
MD5 b22fd460bc0fec230e45708bfb8668b4
SHA1 c1efbda101640b781bb10ba6537ec6a9838980e7
SHA512 251dbf2a339872a54f0ac0917de88f5ca4625d0de99d65836ec1203bb2bfdba76f89e2ce9a71cc7aa8059a619fbffa5da246362d5956a6b2c9c7d1af8421b15d
SSDEEP 192:vR9vNDZ+dCpGJXv7cpGPRpcq769BHsb+WNnp29If1KgC/Fe4GSY8ZVyIsnAUgraJ:vR9lO/weXberwlogCTGW/e
TLSH
T18E52E92EA9102A7B6CDBD319FDA5BB57E3F5102236842E80E6FC8B1C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 55207fd3b4a2da5b01ef68530cca3b2168b18ebdb26a1fb263ac37c3429b24e1
MD5 95963383bfc40851e830dc80fa9ca378
SHA1 14651e83d69b0a748a776b027eacb538b4565eea
SHA512 127bc98ebfa0f9e8c755d8be18d5969383ff34e51ca219646ffd5e5d09b597c0931b946137cb0694a6a8c2171d33fd20678aa79de7e6348cc9b3a2022f3617e7
SSDEEP 192:vR9vNDZ+dCpGJvv7cpGPRpcq769BHsb+WNnp29If1KgC/Fe4GSY8ZVyIsnAUgraJ:vR9lOnweXberwlogCTGW/e
TLSH
T18552D92EA9102A7B6CDBD319FDA5BB57D3F5102236842E80E6FC8B1C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 149de308a8c56fcd7aebe999ad7a4733b324090da8a8d9b9fd071369b0471e4b
MD5 c39be716ba86808dfec73ed0d9df7802
SHA1 f2078bc5f73b07d46916426e74e87801148e6312
SHA512 c68f0541abedf9d7d0e87fc68e867000a46516160ac0b943fae52e4fbb78a8fe19b972d2448dd9ba9441919ff866b2f42ba9e773f92374e7332241b8b5010b81
SSDEEP 192:vRAvNDZ+dCpGJXv7cpGPRpcq769BHsb+WNnp29If1KgC/Fe4GSY8ZVyIsnAUgraJ:vRAlO/weXberwlogCTGW/e
TLSH
T11852E92EA9102A7B6CDBD319FDA5BB57E3F5102236842E80E6FC8B1C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 09ab288ee86f1304a598b14c9893b725434d446f41c25bbbd26cce2946e399ee
MD5 eba66b4d54e33bebb21080cd1e9b8faf
SHA1 d80a24de00ff98babbbdf6470600ce49ddb25b4a
SHA512 b818aff2d91df6f6c2afd7cee64239f5fa33f7d6bc86390ac1c34807515f59ca1e23bb21f338e4a6467c48a80f157bba05f83341a18a093566918374a76dd390
TLSH
T1EBB0125080429101C04346F41183148C71349F10960E170943E46923C8251A18114251
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6ea9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a6ea9.TMP
Size 96B
SHA256 7e44ca9ceba91c4dd38fb36d7871c5bf685e60c7a43b3a6a1c1b71cd05ff697a
MD5 4c533bc98dfce8d44691631a4f7b2a37
SHA1 68ac8c830c452bb106bb75adc84c0929e4e8badd
SHA512 a06ad6ad4d85f684cc21873c5644dfdff7fe0ab0597e8c40cf3e56c3c2fd218ee78b52b67b2711a357ace6f2ffcab1299a15c0a40cd6d8d048308ee809ce7352
TLSH
T138B02200C0022203C00203F038C380ECB030EF3ACA03020E82E00A22CC22A20002CE20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 8c706d17f865eda5ca85b9974ea4a2681765cad21ca073cfaafae9990eab65a0
MD5 fa71b7c7837351b7720900c95e911e2e
SHA1 3c1bddb84c463c3e59c5cb03e483878325aaa187
SHA512 152379f8bef9bbc0700be06924857412cf9d9f448e996ea8b4840f8093fe807f151761a7cda1c8e5a558725e8acd76cd0828fb30a7f9bfa931f5c9fed7fbac2b
SSDEEP 6144:Vmg1kQfATCFbzQACj/FmUi21rSm8uUVNSlzYJ:1neAWfi21b8j8z0
TLSH
T1553423099EF15DF66F0A105036C62E74EAE84F52CB824E8043331BE25EDF6C71B8B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4502aea9b3f4227d0b9f514129bffc5bf3536675b1be4603678a0b06d0e62ef4
MD5 2bfa35207268e834c212174a61f1fb7a
SHA1 b482a43673b2614144b972f0c9f3a5a0d6e60acd
SHA512 9427324281846f70b0fd31766acd4fac59885d32486687c1e07bd149eeddc591564a883941f466ad816c48e775dd4690277f118bb3cda323054d0463cab4b5db
SSDEEP 3072:SAFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:pFmUi21rSm8uUVNSlzY/
TLSH
T193C3130076E3E9F2EF5930447BEE2A149D6C0D818291C6415273AE419DEF3C75FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 0341dd88a03f4febc5cb42042722ca926f1a5eeb93fb94c52d25c9434dea6cd6
MD5 74d605821c8ab07511561f8a819c885d
SHA1 49d15b9a6d237539baead59434193d54472ea720
SHA512 d07bf30678b26e5ba1d3e77c4973f1100003168544dd3f1cae20d407f4171f241443b17e623477f9820d732c9eb8c63d73974c8154dd835b87d1bb43ce90dadf
SSDEEP 6144:omg1kQfATCFbzQACj/FmUi21rSm8uUVNSlzYJ:0neAWfi21b8j8z0
TLSH
T18E3423099EF15DFA6F06105036C62E74EAE84F52CA824E8443371BE25EDF6C71B8B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 426ed30629ad9f4a8433685eb6193cdf9858c38ddd1fb401f678d2719416ecd5
MD5 ad9eab3b9d9e1458e9b754a52852ec2d
SHA1 beda970a1c83febfd55757dc3b60f0d69d7f8e93
SHA512 8b04c8899a1a0fa2a88ed55fdafd7299b6019beb1e06649e3a5911eb794f5cb90ef06653fd8ad569a5a373274ee97fe05a174adcaef312ffd7e442a0e429ee84
SSDEEP 6144:Kgmg1kQfATCFbzQACj/FmUi21rSm8uUVNSlzYJ:rneAWfi21b8j8z0
TLSH
T15C3423255EF159F62F06109036C62E24AED95F57CF528E4443335B926EDF6872B8BC20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vexor-updater.exe

Path C:\Users\Admin\Downloads\vexor-updater.exe
Size 2.4MB
SHA256 902584a04274d0cfbb766ace6f0b52d90d4b43bd0c6bda89ca5a6547662f02b2
MD5 468d4be3b71eea444c233ea682ea2f29
SHA1 21559b0d04719811d35d2482c0b455b8540e581e
SHA512 5422b79836480232ce96f2be8022e5149e1bf1382c7c86ab26812953de41f821753f042606443348a1d7ef6ce4fd8257c0ff9b6d1ecff5b1018791ede7e2d168
SSDEEP 49152:HoaFRu674+P2Jn2fpJ+79akz2UsnE73nowWx2mk9GDBWASp:nDJU9Tsnzc14Dm
TLSH
T1F7C5CF4552A916ECC176E178D706A617FA3A34840B309AFB1BE14A162F63BF3577F320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download