5d6e7917fc180dcd9329921823319baa22844c0bc25332431acdef565fb08c09

Analysis

user interaction
yes
max time kernel
365s
max time network
376s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ymods-Loader_1.2.3_x64-setup.exe
Size 164.0MB
Sample260731-ejn71scc77
SHA256 5d6e7917fc180dcd9329921823319baa22844c0bc25332431acdef565fb08c09
MD5 b88b66eb6e7eecd54372c6b774a487ca
SHA1 4d7a1eede6fad648bf8ab496ed32ee68d165ad8d
SHA512 4a0524e72aef9e7acbee4994227553c678a72015231385239f6a10ca6b976e6dabfdfc8fc16761d857aa35ac448fd44500f18b8f097d58192403a2d635498799
SSDEEP 3145728:dT2zzskaaRK4/dcG4/GJcxCz5hHdgT070JOQhCmzqdLISc67fJ5WZnZ+JGZ:0XVK/GJcx+hHdY07c3EI0J5IaGZ
TLSH
T1AC8833A33189DF3BF1E695F2E59AA150F3DF7347034A2B0073699DC2A0119968A1C9FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1464	ymods-loader.exe

Loads dropped DLL 7 IoCs

pid	Process
2740	Ymods-Loader_1.2.3_x64-setup.exe
2740	Ymods-Loader_1.2.3_x64-setup.exe
2740	Ymods-Loader_1.2.3_x64-setup.exe
2740	Ymods-Loader_1.2.3_x64-setup.exe
2740	Ymods-Loader_1.2.3_x64-setup.exe
2740	Ymods-Loader_1.2.3_x64-setup.exe
2740	Ymods-Loader_1.2.3_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ymods-loader.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1532_1987639643\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1532_1987639643\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1532_1987639643\manifest.fingerprint	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ymods-Loader_1.2.3_x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299444563477788"	msedgewebview2.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader	Ymods-Loader_1.2.3_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\URL Protocol	Ymods-Loader_1.2.3_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Ymods-Loader\\ymods-loader.exe\" \"%1\""	Ymods-Loader_1.2.3_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\DefaultIcon	ymods-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\ = "URL:org.Ymods-Loader protocol"	Ymods-Loader_1.2.3_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\DefaultIcon	Ymods-Loader_1.2.3_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\shell\open\command	Ymods-Loader_1.2.3_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Ymods-Loader\\ymods-loader.exe\" \"%1\""	ymods-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\shell	Ymods-Loader_1.2.3_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader	ymods-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\ = "URL:org.Ymods-Loader protocol"	ymods-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Ymods-Loader\\ymods-loader.exe,0"	ymods-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\shell\open\command	ymods-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader	Ymods-Loader_1.2.3_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Ymods-Loader\\ymods-loader.exe\",0"	Ymods-Loader_1.2.3_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\shell\open	Ymods-Loader_1.2.3_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Ymods-Loader\URL Protocol	ymods-loader.exe

Modifies system certificate store 2 TTPs 12 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3352000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	ymods-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	ymods-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	ymods-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 19000000010000001000000021d008b47b7a2a81c8435903ded424c90f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a012000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f33519000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	ymods-loader.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2740	Ymods-Loader_1.2.3_x64-setup.exe
2740	Ymods-Loader_1.2.3_x64-setup.exe
1464	ymods-loader.exe
1464	ymods-loader.exe
1984	msedgewebview2.exe
1984	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1532	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	2740	Ymods-Loader_1.2.3_x64-setup.exe
Token: SeImpersonatePrivilege	2740	Ymods-Loader_1.2.3_x64-setup.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1464	ymods-loader.exe
1464	ymods-loader.exe
1464	ymods-loader.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1464	ymods-loader.exe
1464	ymods-loader.exe
1464	ymods-loader.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1532	1464	ymods-loader.exe	82
PID 1532 wrote to memory of 4744	1532	msedgewebview2.exe	83
PID 1532 wrote to memory of 3756	1532	msedgewebview2.exe	85
PID 1532 wrote to memory of 3756	1532	msedgewebview2.exe	85
PID 1532 wrote to memory of 3756	1532	msedgewebview2.exe	85
PID 1532 wrote to memory of 4032	1532	msedgewebview2.exe	86
PID 1532 wrote to memory of 1524	1532	msedgewebview2.exe	87
PID 1532 wrote to memory of 1524	1532	msedgewebview2.exe	87
PID 1532 wrote to memory of 1404	1532	msedgewebview2.exe	88
PID 1532 wrote to memory of 1404	1532	msedgewebview2.exe	88
PID 1532 wrote to memory of 1404	1532	msedgewebview2.exe	88
PID 1532 wrote to memory of 1984	1532	msedgewebview2.exe	91
PID 1532 wrote to memory of 1036	1532	msedgewebview2.exe	92
PID 1532 wrote to memory of 1036	1532	msedgewebview2.exe	92

C:\Users\Admin\AppData\Local\Temp\Ymods-Loader_1.2.3_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Ymods-Loader_1.2.3_x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
- C:\Users\Admin\AppData\Local\Ymods-Loader\ymods-loader.exe
  "C:\Users\Admin\AppData\Local\Ymods-Loader\ymods-loader.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ymods-loader.exe --webview-exe-version=1.2.3 --user-data-dir="C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1464.2028.426748693515834949
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffa816db078,0x7ffa816db084,0x7ffa816db090
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView" --webview-exe-name=ymods-loader.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,14633843525486795851,895103108957015152,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:2
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView" --webview-exe-name=ymods-loader.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1996,i,14633843525486795851,895103108957015152,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
      4⤵
      PID:4032
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView" --webview-exe-name=ymods-loader.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2276,i,14633843525486795851,895103108957015152,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView" --webview-exe-name=ymods-loader.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3540,i,14633843525486795851,895103108957015152,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView" --webview-exe-name=ymods-loader.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4340,i,14633843525486795851,895103108957015152,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1984
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView" --webview-exe-name=ymods-loader.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3592,i,14633843525486795851,895103108957015152,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
      4⤵
      PID:1036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd3FD5.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsd3FD5.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd3FD5.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd3FD5.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnaClient.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\AnaClient.jar
Size 34.1MB
SHA256 7200ed4e8f4ba8d8e22dd727a6fbc62f83f0f53f72164e705157755f09b1b931
MD5 cbdead751b69f12f66cd5c460df808d2
SHA1 dea514993ca80fe0af235f391e2bdedc72c67fd9
SHA512 31225bcb03a5ec40e71ff784d551bfb611ef358659ba4a6172e42fca5ccf3d5bff89bdbccd2242799650696f22d78470d1f8eb8a3ac76952a7baf81f7b4b77c5
SSDEEP 786432:kTSja2lG4C/sNdFfQKnxR8j6TKZk6hC8f27VMuyxm:kTy24F3xSvym2GC
TLSH
T1137733267F4DC579EA03427B9181C493786962E9C246B40F25A41D6F1DE3E9F0F0AECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AstraClient.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\AstraClient.jar
Size 16.5MB
SHA256 7f4a37b83bf4a3c4b87cda2bd5ee5e0bc6ae0ff0009cf447466363a6d9d71e12
MD5 6af42089042c5dad982646dbc8654ee7
SHA1 d2cc88bf32f5befec392cfc03db00d08f8bcfea9
SHA512 35a2a165ff483efccceb5ca147a0c3835a60663db5c78117e3d2320419f6e871514eefe4a633b9eb88d01d42f5d3d0e4bec7169fa294d29a4a344da0264c3baf
SSDEEP 393216:bWgDiv6YQ34BVayq6lOqeoRY/ALSNNgb9I1ax77XoUl:Hiv6YeEq6lPLWzax77XHl
TLSH
T1400733DDFEC8C91DC1A771BC44958143AD1C01BED20CE01B91A5AB9A24BAED98B07DFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Axylis Client.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\Axylis Client.jar
Size 20.7MB
SHA256 81160be67d3292dc1511f37357bcb0b95459a65df2a94cde151a3f189db78eb2
MD5 b33f14fd4e7b16da0b8ee0f7cae989a4
SHA1 22d1d9dda512d7f3be107dec01d070dd2ef28c10
SHA512 e994c060e3a55de850bc88f91af77198e35e19b549ee3585f50a88fc8bce201693ebe6f9a2dcd9c792d51c3bf2041fa39f70efe670a954b16e4b84ae8aa1e57a
SSDEEP 393216:3/ibmiIlvvVceNghM0dPEiROT4TZcM2e1s0n62T9qPe5G5RJyvqRq:3K8pOxMiET4uM29QqPIoJeKq
TLSH
T19327332C7ABA943DEECB427A7111DA937A7042CCE301F10F3965D18A24E195F9722EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hatred-Cracked.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\Hatred-Cracked.jar
Size 35.6MB
SHA256 e5a8eb04ed17bda521a59d5d2e6cccc8be5d2a231d46c8343ba354fa9fc0586b
MD5 03940ee1fdf0b361d72f80631f23e30f
SHA1 31ab63ec70296793e7e06d6769648610f490cc97
SHA512 73e8c2894bab0e7dbbc23c2d29d1f347872c9dc1db30c062cc9d79d0d49534f0d02c765bfcc922642025aa261bb04f70df09e6b50e5a49f8ec05d18a1abd62a4
SSDEEP 786432:8jCLprS5C/s/TrA/Ly7wb1eOT3Ea3nibs8P8F8mWaWk22TmEJovI:8jQpE/TMDgU1RYs05f2TNog
TLSH
T123873333BECAC566F82782B244C08253FC3A50DA92496D1F15A04956DDA7D8C1B3EFDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Veltragossa.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\Veltragossa.jar
Size 25.0MB
SHA256 a9dc263076162c1e75fd31bc73a00d41333f70da378c107678e0ca0b806713ff
MD5 179515935dad4bb4b84c014c843c799a
SHA1 99adf2df3aaf204443229f4fa02d8f297cccd8bc
SHA512 c2ea84eda700651ead90d1010f9aa79144ba6d28729a6ccb5f8646ea0254372f281c2fc33c876a833db9ad62a41bfe7349fd95c7b76cebb7fcba469d6c39d115
SSDEEP 393216:ihSSaVRmSjMcRAra8WJi/SL9TBi8kUEuP5fcwlDITzU63ae+a3hL0ZNax0VLArkD:OEjIcurZ/S5To2yNuM90Zg0Vcr6GI
TLSH
T1844723257ED5C82DD15B8073559184D6A82C22CEE44BD0AF47B8098A6DF6E8F4703FEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fabric-api-0.116.4+1.21.1.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\fabric-api-0.116.4+1.21.1.jar
Size 2.3MB
SHA256 263d884fe30cd53be977b83b0968cb5dd51ec77cc4c50ef78f52fe5930ee2afc
MD5 aa1660d1af25eb18790182753f977615
SHA1 39d1a6b6213d012649821ecc516ed5b5142478ef
SHA512 95060def77b54ba6c6eb5af45b478ec6926f33f145d8f3933cd90cb2b6ab6913459d3d0afa3afcb01fca07d714628414a41ee8b6845261e88d92b83bfc668ad8
SSDEEP 49152:e4KES8JxD4gMyOZ8TlfJjOBDCGhGTrXdR8MrEB+aW3Wna8K3KB6Eoxj:jKP6B4f0TV6eGsJeBLXvK3OPoxj
TLSH
T184B53371BB0B6149F1D2F8B01980D8864A31F59E58AC9FD897FA3C08DFA6D7E5385318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fabric-api-0.119.4+1.21.4.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\fabric-api-0.119.4+1.21.4.jar
Size 2.0MB
SHA256 d183bacb845167f09264c2f90322b7ecffe8826debda6f60e597889264bef4af
MD5 128a8d042180e7c92567342e21a21a6d
SHA1 1c7871b6af04edc8b8f0dbad12606d67f6118a11
SHA512 16b679f6a42549ca3b6bc147de710b2c8ba2d5e4661ed88df22782c05a4a5f6c1163d7b13867687ed91acde0fdfe5a5037d05662431c946865b58396284e7ee7
SSDEEP 49152:qysKlZXgbGfRCPAalhVUpGhJfOglIdW/JfSyYsNaoO3A:n/ZQwTalhVHLAW/BRJUA
TLSH
T164A53364F29A1D1CE497F8702CD2D9E18C0794CD3B218B1B759931964A4ACFBB3623B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fabric-api-0.92.11+1.20.1.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\fabric-api-0.92.11+1.20.1.jar
Size 2.0MB
SHA256 3278787c04ad636525b5c3400dff8302420f79279f6d51ce3edc0149060d12eb
MD5 480888e4128874e4be052b0e7ee81697
SHA1 2824689367eec2b52c6085e968343751137e66bf
SHA512 fb8d9d5c5ee387b12770fcef1cb4327f1575bd21606f1a268c9eff43fd3697cf0a3af55dd688cdc913f1423737f8905e13282eb69dd69f0995c32d6e620efb3f
SSDEEP 49152:sw6yLzI3PVF+6U3l4sycTB8dGH7QN1GxML6c7D12k4LQ4Iiqn:sw6y6PgTW806xMPV23LQ4IiI
TLSH
T113A53377F4485096CA5AB8BE7801A6045240F8EE3B0CFFBB1045A66C2FF5FFAD150A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fastclient.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\fastclient.jar
Size 394KB
SHA256 2088a4dd0971370bcad9456ba444589119179ca2bb6a4feb61bccc2c4c8083b6
MD5 2083018995f921df519fb3bed5028215
SHA1 2f9249f9bccd0f3eeed47b9dd4afdb0f3015fa52
SHA512 c8b3ba5c62f34ce552dea80a1d8eb2f34dd91e3a5f11f4065b523c3a21141c6227b7663fcded607014c536c8c40f3c6c73d9957681765754220522e72f7afaab
SSDEEP 6144:9EGjOyKIhyyU7Of/7PbmwqHdTw2rYJANp396bJhWbObEJ7xxeVIDiOmZvHQt+JFm:FCu7PJq9ffNpN61h+ObymIDZm6tll
TLSH
T1D28402D23DEA8675E627F431E5268D13BD8B0149DC09E0E70EA41FCB2DA5D2987077CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sakura 1.21.4.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\sakura 1.21.4.jar
Size 11.2MB
SHA256 37b8fe0ebb1a5c2c06ce7513aeded0277f79d6c255198de4ac9f5015e96120db
MD5 d613539157516a78148859274b7479f2
SHA1 e5c7d5c5b09b43d87ac4adfe963f9736a7ac1271
SHA512 00bde03e2358027b3c77f7f14531d71fa993ca1ff7095a17d085b0ff172ed5bd14bd3507d16d3c6443874996f73066b470f9ba30e533e98e107ca0dc858b8cb1
SSDEEP 196608:0Vc9IBjZG9uCkvtuxZxKgVY0WCUgYcOajsb+hjMvrsuBJQ3TWUH1y:0V1ZHOOcGCUgYBt+BksUqCUE
TLSH
T1AFC62265FE99D93AE0876077194080F7A52913DBE046E01F8EA00ADA99E0D5FC707FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

satin-3.0.0.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\satin-3.0.0.jar
Size 96KB
SHA256 d7d7924563194d42705eeb646ca021560114645e1c2cd46b3a9a37565ecb3dee
MD5 2cf1534f9e818bd567837979444557e9
SHA1 03fff6ebf3ae3a44aaab339f0104a0a623fd3b07
SHA512 10df3022a85b6d20801dff8ba25a516ed5e8d749eb9e25b32c193c5ae6fcc5d67dc4ff8f4fd9df808d6332ecffe9af1468b737f0950398f3e173274f997040e9
SSDEEP 1536:Qglby6Fp7MUZTaXJxBXUQNjxHeTUO6oW92CyJafm19OoWKwVxjn+f:RbyutMAaJxBEQN17WJaftKwTz+f
TLSH
T199A37C15FFE7E12EF0A7853241C38A536119829853C6E11F24E31A9A98E6C774B17FCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wild-1.21.4.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\wild-1.21.4.jar
Size 11.6MB
SHA256 3239e484570ac250ed639117dfedb9333f936d3b75a3154a8d80e82eac6f43fc
MD5 5a1e18c864cc487002d9f9b64734b161
SHA1 69dff973f3166a1c6e8de9408f9892e9da3d9b95
SHA512 21bc522d125a5921c625efce2247f6b20e325b26234bb99b0235b26ecfc5582c6c2079c0f3d67942dcfeae6ac5fd2661326122dec59ebb3adf2b1f665d5f1261
SSDEEP 196608:nI4AugOFHJkSFt4RsCQkjNWOr2ur7KL/j1hA8N9LatmgZ16ry6:nvHgakSX4RsCf4Q2os/j1y8/qmISy6
TLSH
T1D8C6335978AC507EC48BC235D400C5A36A2B914D540B761F2AB44CAF8CFEE6F5726FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ymods-loader.exe

Path C:\Users\Admin\AppData\Local\Ymods-Loader\ymods-loader.exe
Size 13.9MB
SHA256 1cfbda0255c5d6e46994e640b7d9a121e1733e1e761bdcfc70ca472a1f6ac050
MD5 477f859b6fbdfb1bb78810203e00a27c
SHA1 dcb2fd181f52845f58dc1f7b367ac0520b274838
SHA512 a8452f4e74f82cae0ae2d517819a3e2faa441d99b7eec9c463d19d5bd03cae795d63e4556d83bfa4809231a3fa58672a22366de5b5e46df061e99ba5a0ead6e7
SSDEEP 98304:RKvlNlWVAJVreD+bLE1UA1adrwgnFv6PobThp1RZ7fFuU7N/SMnBY9gHHE0mniuK:kleVBqLJtZ7f7/NBtnJmiu+ieAW
TLSH
T160E64952F66280E8C17AC075935A6233FB71788947357AEB5BE48B313E26BD06B3D704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7faec63d2d7bedc665e0b717fb41b780b9618d6339f3c6396f631cc411a5774d
MD5 690317d1f35917cb1267fc083edabdb9
SHA1 94e86b3bee71596114d05983887bd90b5bc09af4
SHA512 f9d6e6c16c235845410cfa8ebbb18e3253d6eda77bc097152b46358695fb87c883c642560db33d81070bc683fd1bad749fe600c9a99756e69447b8c435f2471b
TLSH
T1B8D0121672818578C11030B70843E5C80401E11B44454000642C861D1A840941D06443
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3d3607925d6841bc8a0944fd53fb54db2473ca151a5ba5f84921e665c8aeb5da
MD5 0844400fa97db8845e2ad86fd757ec8a
SHA1 748730e734fa8d87888f6a6550d89d8e5481c658
SHA512 b03349bfb6c517a241fb4321481dc233b74e4b30404d4c27f74a3a2312c0295fa00505d2f6a2bc4e115308272652ac92120e074677625714f95f287528a93f1d
TLSH
T194D00454D1C4C454C30530FD4C55C5C0410574530C4115001014010C04C01451445003
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 3e71242881f287d9249b04e32007b808b660a639c8b6a648cc9b8370902e0868
MD5 5136d4c44932b48e824a27498e474af9
SHA1 739e4207fdf467224c66eea15ddf736726a6950e
SHA512 3eec55098aa435c31c4905ea9761acb592c2ec83e90e3bf27f75edd1edae94c9e58e14d5020e706cd8aee3eb0c832f46a88fbde2b644d32dcec690388d762a82
TLSH
T191C08CE211F14E50C70191B3C4C3C08031FD371A892F0DF4AC81127040387200A91400
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 82098be62408054c44d1336b27706e50ec0a74c454ff27458febb450e2d34b8c
MD5 346b19a16ce16ea04ec8e827b09e2f52
SHA1 f7d8555564b429746d8a4e56e9aa7139fb50f48e
SHA512 ed7ae371203a5c830242dd0910b9ee888251e166201eb027151e84446a930e9f9d8580492e27c1539473fa025d6371c0b6e2ceacc39e9f187865004d48557c6e
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8e86.TMP

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Network\Network Persistent State~RFe5a8e86.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Preferences
Size 6KB
SHA256 6d02a6590de21f334ee099212d887b82344979a079c5073e4ade9bef15fd9cb4
MD5 ebc0ab4a631f94b54cd072974be28fb7
SHA1 4fcc76d05444963a72bd238b9ef2a7ec5952ba26
SHA512 8ed44076f41527dbc8a68910b261f1e05d7c5052bd9796673bd51d8c21276cccef01f2868ad6069009019a6550dc80845b411f8097c9ec4ae1c602274bb76eda
SSDEEP 96:stGW05Gzc/upib9wlffzZ8i0vhEHktdm/7qx+WVHMSm+uecJnU1idQjx+gX1j5MC:stGW0CzJfrZ8paqg/S+WiTnUwdoD5MC
TLSH
T199D1A7065E2869774CCBE6197A36BB16E6F65073A5C50E98EBFCC60C05D66CC1307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a0745.TMP

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Preferences~RFe5a0745.TMP
Size 6KB
SHA256 6cafe79e44fc2ea8e7dd4b43278ecf29882b7cf546fe0ff61d92972730f1fdee
MD5 f0eb54b6b8795c1cdf99b4c71bb4100d
SHA1 3be2b0290b6da61a03acdbca17def12ce2f58dff
SHA512 1511913c37c1cfd8dfb785c641069ad32a6e4a9a2c602ea14e15d895c0a944befa1aef106484eeb95ca9b90a1e569cc36a2dd57ea6e97aeaf1fcd3f75b2f8ef7
SSDEEP 96:stGW05Gzc/upib9wSffzZ8i0vhEHktdm/7qx+WVHMSm+uecJnU1idQjx+gXrnj5x:stGW0CzufrZ8paqg/S+WiTnUwdoh5M8
TLSH
T1B3D196065E2869774CCBE2197A36BB16E6FA107266D50E98EBFC861C08D66CC1307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Local State
Size 1KB
SHA256 cc6a00e0c261f61863bcee210ed1a9701a243f230c3a1673726b68f86d7144ca
MD5 afe406899dca323325e5db19a3404971
SHA1 9a581df5afce71252fdf4b32ad77bf5b24116ebf
SHA512 bcb96cc81aa6b196fdf0d3203fcfbf7d74fd576637d404f2c0a8367445371962dc10d3c8f29d50de8e64ba322a9d1b0789211d7ddf1cd355b39742583e2144ea
TLSH
T11C3185B2E5D81B766C875543B10336873F201072E2216F44A2EE872802E779C832AC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Local State
Size 2KB
SHA256 f74d2833e2b5de0f5d1f0629c8ab50a3c86c74dbc9321d9b4319ce759d7b7eb3
MD5 b2a0eeb5e710c83c054c90ce273cbea4
SHA1 1fc15328204e447ad22ff1433d0c7a7a74bc61f1
SHA512 daf2de3331c7d42f1793201aaf7b3eae9af7567eb8e199c729900eda570115fa9ff9db3fbf8c46186f6b3c28fcab08613bd34c574488974ff1b7372ba985f1fc
TLSH
T1A251B473A8589A778DE75645B94A3B23BE3550B2EB623F4096ED0B1C01DB75C1306C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Local State
Size 3KB
SHA256 8eba56771adf6326018afcb849d702284554b246ee6f75ba4868c799add1a0cd
MD5 bb03cef0d80553bf39455c1ce6fa7a27
SHA1 e2f954a8503eba21e0305727eee655472a60273f
SHA512 7471b0204616ab12ee7aa314862c763646f2cd7bfc1bc5dbfd3f9e297041993b81d9946395bf4fa63024c198944af9461138a465821749937f99717d6251cc22
TLSH
T1CB71D637A9A89A7B4DE39901B8863B177F611173E6913F94D6EC0F1C01DB3981301C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Local State
Size 16KB
SHA256 466661918f0dcfb500ead69327806f3fd5f17b4d9ab2d00b7aacb559d3b28cf8
MD5 9662f32605f77e12202740a15d6cfee9
SHA1 0c978dde661729cc04437ad76525ea8d48c60fc0
SHA512 cf27efd3ce9fac88da188d31fbceed7fa03c73f9c1cd4231b148ea6504cbca93907b0178aadc05b80269377a5d4a4b5f114bb30c59d08d8d9b2acb88d41b1fb9
SSDEEP 384:zg+aQikB+z/xvxjg/qhEwNb0Zl1X839ze:b/UxvxjgC+FHR83Fe
TLSH
T12172AE3B95686E3359F7A50679490B8BEFB984B2D1C17BB84EED5F0907DB3980302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe596807.TMP

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Local State~RFe596807.TMP
Size 1KB
SHA256 2cc2f7edab08bc26f39afc56ec989067c58c838beaeeaac179e4df3a1e753623
MD5 cc9fdbe9578ecb2abf3174036d83c58c
SHA1 4aa4f106809a466cbe86d3e04f86a577857ab34b
SHA512 b266e034bb0ecb332cd732f9b5fc1ac484dade87461cb2464d2cc594445b90238559d61f28e1bf2fe8ef1de1ffc7d050cb635aa674668a38c59e358f4354f15e
TLSH
T1202162B3D8DC2AB6AD874542B10376873F1010B2E2206F08E1DE932806E769C833AC37
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Ymods-Loader\config.json
Size 1KB
SHA256 4c1cc8fa5a8e48b06a1e616d45ba457d8333c6379f4c3d01338a973313e55efa
MD5 15f1b840ee4ac42a2e2e9e69a0ae4607
SHA1 668861c441d3af65144358d4ee9ccff0f59ac68a
SHA512 471fd4003234c5c2404ba604650afce09636ceac75b104151e1f0fcbacac8fbd458afe811014056e8e1ef4d441b5e00226e6b77a25b8aff4b55502e7fb5227ac
TLSH
T144116A20E97CACBB00A01036647B600375758E9F05297F7C719A84EC7F2EE6DA07A4E1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1532_1987639643\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1532_1987639643\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1404-220-0x00007FFA9EA20000-0x00007FFA9EA21000-memory.dmp

Download

memory/1984-430-0x000001D025390000-0x000001D025391000-memory.dmp

Download

memory/1984-429-0x000001D025390000-0x000001D025391000-memory.dmp

Download

memory/1984-434-0x000001D025390000-0x000001D025391000-memory.dmp

Download

memory/1984-440-0x000001D025390000-0x000001D025391000-memory.dmp

Download

memory/1984-438-0x000001D025390000-0x000001D025391000-memory.dmp

Download

memory/1984-439-0x000001D025390000-0x000001D025391000-memory.dmp

Download

memory/1984-437-0x000001D025390000-0x000001D025391000-memory.dmp

Download

memory/1984-436-0x000001D025390000-0x000001D025391000-memory.dmp

Download

memory/1984-435-0x000001D025390000-0x000001D025391000-memory.dmp

Download

memory/1984-428-0x000001D025390000-0x000001D025391000-memory.dmp

Download

memory/3756-101-0x00007FFA9EA20000-0x00007FFA9EA21000-memory.dmp

Download