0032588b8d93a807cf0f48a806ccf125677503a6fabe4105a6dc69e81ace6091

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
139s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 274B
Sample260802-sdxh4avhle
SHA256 0032588b8d93a807cf0f48a806ccf125677503a6fabe4105a6dc69e81ace6091
MD5 dde72ae232dc63298465861482d7bb93
SHA1 557c5dbebc35bc82280e2a744a03ce5e78b3e6fb
SHA512 389eb8f7b18fcdd1a6f275ff8acad211a10445ff412221796cd645c9a6458719cced553561e2b4d438783459d02e494d5140c0d85f2b3df617b7b2e031d234b2
TLSH
T157D02E723688C4A8E4923EA90EAA83CC5D28A9A034C3C215084AB6B098801574E336EA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2868	powershell.exe
4408	powershell.exe
5548	powershell.exe
4428	powershell.exe
1564	powershell.exe
3320	powershell.exe
5628	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
5000	MVPLoader.exe

Loads dropped DLL 11 IoCs

pid	Process
5000	MVPLoader.exe
5000	MVPLoader.exe
5000	MVPLoader.exe
5000	MVPLoader.exe
5000	MVPLoader.exe
5000	MVPLoader.exe
5000	MVPLoader.exe
5000	MVPLoader.exe
5000	MVPLoader.exe
5000	MVPLoader.exe
5000	MVPLoader.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1708	cmd.exe
5284	cmd.exe
332	cmd.exe
2408	cmd.exe
3060	cmd.exe
11676	cmd.exe
13348	cmd.exe
1400	cmd.exe
1940	cmd.exe
1712	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4436	chrome.exe
7200	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301565238861844"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MVPInstaller.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
5548	powershell.exe
5548	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1804	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe
Token: SeShutdownPrivilege	1500	chrome.exe
Token: SeCreatePagefilePrivilege	1500	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe
1500	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5000	MVPLoader.exe
5000	MVPLoader.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 3400	1500	chrome.exe	79
PID 1500 wrote to memory of 3720	1500	chrome.exe	80
PID 1500 wrote to memory of 3720	1500	chrome.exe	80
PID 1500 wrote to memory of 4436	1500	chrome.exe	81
PID 1500 wrote to memory of 6016	1500	chrome.exe	82
PID 1500 wrote to memory of 6016	1500	chrome.exe	82
PID 1500 wrote to memory of 3028	1500	chrome.exe	83
PID 1500 wrote to memory of 1956	1500	chrome.exe	84
PID 1500 wrote to memory of 3028	1500	chrome.exe	83
PID 1500 wrote to memory of 1956	1500	chrome.exe	84
PID 1500 wrote to memory of 2412	1500	chrome.exe	87
PID 1500 wrote to memory of 2412	1500	chrome.exe	87
PID 1500 wrote to memory of 5876	1500	chrome.exe	88
PID 1500 wrote to memory of 5556	1500	chrome.exe	89
PID 1500 wrote to memory of 4204	1500	chrome.exe	90
PID 1500 wrote to memory of 2500	1500	chrome.exe	91
PID 1500 wrote to memory of 2500	1500	chrome.exe	91
PID 1500 wrote to memory of 2660	1500	chrome.exe	92
PID 1500 wrote to memory of 2660	1500	chrome.exe	92
PID 1500 wrote to memory of 5276	1500	chrome.exe	93
PID 1500 wrote to memory of 5276	1500	chrome.exe	93
PID 1500 wrote to memory of 2164	1500	chrome.exe	94
PID 1500 wrote to memory of 3864	1500	chrome.exe	96
PID 1500 wrote to memory of 3864	1500	chrome.exe	96
PID 1500 wrote to memory of 224	1500	chrome.exe	97
PID 1500 wrote to memory of 224	1500	chrome.exe	97
PID 1500 wrote to memory of 3008	1500	chrome.exe	98
PID 6064 wrote to memory of 1804	6064	MVPInstaller.exe	101
PID 1804 wrote to memory of 5364	1804	msedgewebview2.exe	102
PID 1804 wrote to memory of 4104	1804	msedgewebview2.exe	103
PID 1804 wrote to memory of 4104	1804	msedgewebview2.exe	103
PID 1804 wrote to memory of 4104	1804	msedgewebview2.exe	103
PID 1804 wrote to memory of 4596	1804	msedgewebview2.exe	104
PID 1804 wrote to memory of 3568	1804	msedgewebview2.exe	105
PID 1804 wrote to memory of 3568	1804	msedgewebview2.exe	105
PID 1804 wrote to memory of 3484	1804	msedgewebview2.exe	106
PID 1804 wrote to memory of 3484	1804	msedgewebview2.exe	106
PID 1804 wrote to memory of 3484	1804	msedgewebview2.exe	106
PID 6064 wrote to memory of 1708	6064	MVPInstaller.exe	107
PID 1708 wrote to memory of 5000	1708	cmd.exe	109
PID 5000 wrote to memory of 5284	5000	MVPLoader.exe	110
PID 5284 wrote to memory of 5548	5284	cmd.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcff47c728,0x7ffcff47c734,0x7ffcff47c740
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,11023181941293855548,9684396389316906007,262144 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,9474702959597228332,10022540380972759096,524288 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,11023312991787229242,10551632897000380621,524288 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2532 /prefetch:13
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,471960811305527735,16474560330364464052,2097152 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,10371751817777913774,12027016387929472732,2097152 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,14915625008846245828,2334102718118436915,2097152 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4472 /prefetch:9
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,5463841394778907155,178897316570109461,524288 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4948 /prefetch:14
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,10029460849813004677,17900284083940607038,524288 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5096,i,55150135971569942,1378109468149970659,524288 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5260,i,10116763858092077032,16639638800011049101,2097152 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4548,i,12599423031685902615,7002054120131383656,2097152 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5852,i,1128081027752624840,5608615296831383825,2097152 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,1854993262106095289,1527891209434440350,524288 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4892,i,956170346820758702,8813622347080545194,2097152 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6396,i,13093222202607708402,3768839593442517709,2097152 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6464,i,15252004104227198484,2183441884631572881,524288 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6456 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6588,i,12812337537961707249,6148694392111457103,262144 --field-trial-handle=1972,i,11012560051477508087,9039738444331188236,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6440 /prefetch:10
  2⤵
  PID:13244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5996

C:\Users\Admin\Downloads\MVPInstaller\MVPInstaller.exe
"C:\Users\Admin\Downloads\MVPInstaller\MVPInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=MVPInstaller.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=6064.4668.1905734217681826812
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x140,0x164,0x168,0x100,0x170,0x7ffcd935b078,0x7ffcd935b084,0x7ffcd935b090
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView" --webview-exe-name=MVPInstaller.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1588,i,9675744041859986389,1744101978665216736,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView" --webview-exe-name=MVPInstaller.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2004,i,9675744041859986389,1744101978665216736,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView" --webview-exe-name=MVPInstaller.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2268,i,9675744041859986389,1744101978665216736,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:13
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView" --webview-exe-name=MVPInstaller.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3660,i,9675744041859986389,1744101978665216736,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
    3⤵
    PID:3484
- C:\Windows\system32\cmd.exe
  cmd /c start "" C:\Users\Admin\AppData\Local\MVPLoader\MVPLoader.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Users\Admin\AppData\Local\MVPLoader\MVPLoader.exe
    C:\Users\Admin\AppData\Local\MVPLoader\MVPLoader.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\""
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5548
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\data\""
      4⤵
      Executes a command shell one-liner
      PID:2408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\data\""
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1564
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\data\DLC\""
      4⤵
      Executes a command shell one-liner
      PID:1712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\data\DLC\""
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5628
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" https://t.me/freecult_workshop
      4⤵
      Executes a command shell one-liner
      PID:13348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/freecult_workshop
        5⤵
        
        PID:9424
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffcd7f8c188,0x7ffcd7f8c194,0x7ffcd7f8c1a0
        6⤵
        
        PID:12724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1632,i,4906561194518514135,16668313247072384713,524288 --field-trial-handle=2508,i,8046474358915344319,1123220664935000368,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:7200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1504,i,5794283519679012557,1926227236519818737,262144 --field-trial-handle=2508,i,8046474358915344319,1123220664935000368,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
        6⤵
        
        PID:7264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,15836582752646554240,6279732839421069752,524288 --field-trial-handle=2508,i,8046474358915344319,1123220664935000368,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:13
        6⤵
        
        PID:7268
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3724,i,7921271514594352431,14235894230824712002,2097152 --field-trial-handle=2508,i,8046474358915344319,1123220664935000368,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
        6⤵
        
        PID:4600
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3732,i,4268380251331949600,9247924021731097806,2097152 --field-trial-handle=2508,i,8046474358915344319,1123220664935000368,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
        6⤵
        
        PID:5968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4880,i,13807075409056704677,8582544422380193349,2097152 --field-trial-handle=2508,i,8046474358915344319,1123220664935000368,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
        6⤵
        
        PID:9292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,2368424487733019471,5414851262020631160,524288 --field-trial-handle=2508,i,8046474358915344319,1123220664935000368,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
        6⤵
        
        PID:13420
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,11546516135781041131,7479143975256762968,524288 --field-trial-handle=2508,i,8046474358915344319,1123220664935000368,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:14
        6⤵
        
        PID:13416
- C:\Users\Admin\AppData\Local\downloader.exe
  C:\Users\Admin\AppData\Local\downloader.exe --sync --partner 631081 --distr /quiet /msicl "YAHOMEPAGE=y YAQSEARCH=y YABROWSER=y VID=247"
  2⤵
  PID:2216
- - C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /quiet /msicl "YAHOMEPAGE=y YAQSEARCH=y YABROWSER=y VID=247"
    3⤵
    PID:5076
- - C:\Users\Admin\AppData\Local\downloader.exe
    C:\Users\Admin\AppData\Local\downloader.exe --stat dwnldr/p=631081/cnt=0/dt=5/ct=1/rt=13
    3⤵
    PID:13560
- C:\Windows\system32\cmd.exe
  cmd /c start "" C:\Users\Admin\AppData\Local\MVPLoader\MVPLoader.exe
  2⤵
  - Executes a command shell one-liner
  PID:1400
- - C:\Users\Admin\AppData\Local\MVPLoader\MVPLoader.exe
    C:\Users\Admin\AppData\Local\MVPLoader\MVPLoader.exe
    3⤵
    PID:3212
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\""
      4⤵
      Executes a command shell one-liner
      PID:332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\""
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4428
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\data\""
      4⤵
      Executes a command shell one-liner
      PID:1940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\data\""
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3320
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\data\DLC\""
      4⤵
      Executes a command shell one-liner
      PID:3060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\data\DLC\""
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2868

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B019B539493E4FE713F4C4A322C04650
  2⤵
  PID:784
- - C:\Users\Admin\AppData\Local\Temp\AEAEA2B1-A2FF-48C3-A14A-1517DBFB2C83\lite_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\AEAEA2B1-A2FF-48C3-A14A-1517DBFB2C83\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
    3⤵
    PID:5940
- - C:\Users\Admin\AppData\Local\Temp\CA2D8AC2-E18D-40E3-8C4E-0AC461FEC8D0\seederexe.exe
    "C:\Users\Admin\AppData\Local\Temp\CA2D8AC2-E18D-40E3-8C4E-0AC461FEC8D0\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\A49FCA98-6671-4BA4-8F84-C437ECD6B62D\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
    3⤵
    PID:3348

C:\Users\Admin\AppData\Local\MVPLoader\MVPLoader.exe
"C:\Users\Admin\AppData\Local\MVPLoader\MVPLoader.exe"
1⤵
PID:13580
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\""
  2⤵
  - Executes a command shell one-liner
  PID:11676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\MVPLoader\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e598bed.rbs

Path C:\Config.Msi\e598bed.rbs
Size 912B
SHA256 be551feec642068823d3f5c20dba337907eb210e18ddb139e8ffcec49ed11ff8
MD5 98b0513be0b9732a76856bd988adb1d5
SHA1 23333e3d86067994fa6b8dd063469885f245ce16
SHA512 55c50df7cd897febf010d7049147a8110254a6fbb4c3da9935e365ea0e1e82c1edf401fcfc604cdf5e462f517224eb9a4b8662d08c85fa0c8288b8dfcb458548
TLSH
T16C11AF0F577DD2CAC840C0319BA66EE7A47BF624AF6B0494D90F6D29315D1303F18297
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 3f130072c4be9007466240aa704e77c57b9c0af7a21fae4823d6c6010462b56a
MD5 1f5fe114e95bcf1b1567bd24370a32d3
SHA1 440dccbc3bf323631fab3c8705a205602e76aa0d
SHA512 773742d1d1e2b3c3b935c953c21437fb5730d142320f646c916828271b4d1f3e0afcac2e7013028cdef45f4f10b5d4e26a395af42c621b951132d2fa0670d30a
TLSH
T179F0D50409F8523EF073CDB80AED2865AE3AF9033C128A2903560B892C32B40DE2642D
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4a9c4c641b02c30d1750601debfbf8c4a1e8366c03739db65852e8c16ceff210
MD5 3647e18b3adc8fae1d14902520a1820f
SHA1 8eb44eb5aaf735615909a6fb674b423963832598
SHA512 7e42380bd0e0d7243279b8d23e3515006bd58927761df60d1984716b4d581b43a03fe625d3a386133978bf796e1ed253b8e78acd200bd2f62422f4272cfe67fe
TLSH
T1CBE061B9CE21AC2719FD471C60504741E750131B36C1995F773C661C8FF863B5156C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 bdb379fa64e54b3bfc6a644760500743da90fffbe45b35c4df5b882f75a4cf5f
MD5 c2b837efb7e40420c199f6b218826e5b
SHA1 39c390c366718b5db40476cd4e8789595f835fc6
SHA512 f9b6df8d396fad1f428c0212edd3b458621f6ebb305de8410aabdac6d42b6fa93b13018909b993a3d4a61a3f37ea337462659ae340d073810b19fd12f96d9196
TLSH
T16C019710B443E287EF1D84BC60D70D653963C4EE82721ADE4092C63970E223A9281C38
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 5033d64b538bc5ca93fc8a807e8591d720d5677ef27b2acfa597ffc1f60dc1f4
MD5 6e456531b92d184c380c9213a4966578
SHA1 5b4073762df5aaf34f5e4070b691aba6b306fe5a
SHA512 450ce4ce70fcd012d9c03057f9db48397bc78ad7e3422ef1bb71de730869dcf5f152a1590c9d3d72aa00941ad7d02804a3bdb896901a8c169227ce8299383f64
SSDEEP 192:Diuz+ZWlMRaI/6t0UTv/1lc5IqIBaPpNPrfPevKNiR4B:Diuz+ZWlMRaI/6t0UTv/1lc5IqIBahN5
TLSH
T16EE1B2F7C3D8D92DC91156F8EB156F1FCE2A0914032D3D26C9D4AE1B93E2871D21664E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ac1c10fdf139a2e97443da7156cf6d8125aef2491d561652df117864b0464c2f
MD5 785af3dc51609f3d0fccaad7ea31c0ee
SHA1 8ca8cd34d0501dc7050809e440f94c558558e775
SHA512 4e372ce93e3f0b89314f499fe7d5d696a057b66429b37199d984136f35a556600ca060a953443f62d1b42c65a3c4605c7dd52b8dccf2c461faa9f3126135952b
SSDEEP 192:nR9ckGkXYcniv7lpupAPRp26W9fHsb+WNnuaPVT82Q3awoVyIsnAUge:nR9ck1NuZgUX+Rw7PVg2caTe
TLSH
T1A942B62ABE14793B9CCBD32AF9227753D7F5102521942E84E7FC962C29E76CC2127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7801e3739c52096f60e55215b2ae997549976d80b58ccf4b479ead1b170f58da
MD5 829a54a3dc2d22da928e441f202b20c1
SHA1 5714dbadee659e5e56138f1483323504d0d37eab
SHA512 1f92eace973be1532eae0c8a57e4f2e69d0989352163d6f4a0469738d6a36936082f25ddea2957750a592f1f69ada2ed84ea313c8501e1182b66abbee1a903de
SSDEEP 192:2R9ckGkXYc4Cv7lpupAPRp26Z9fHsb+WNnUz0j82Q3awfVyIsnAUge:2R9ck1yOZgUXRRwQ0w2caKe
TLSH
T1BD42B72ABE14793B9CCBD329F9227753D7F5102521942E94E7FC852C29E76CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 840b6ccdce5c2055c9c63b201ace5a9bdf2536ccedb10dca6aa8fe6251498daa
MD5 7a61b02bbce235d748f9ef8411db2c92
SHA1 dd7a6d1373e1ef752b5f93ffd1e58061b8c60976
SHA512 c9b60134c284d8dd51aad0be9f0d81e86a8f26c07a5ab8ad9080a52c1fc1df89bff6fc3e89909af5b793b9828496fa3a693a8d65e9e4f580c50f148273c8b349
SSDEEP 192:2R98cBzkGkXYc4Hv7lpupAPRp2ZKJW0h9fHsb+WNV0hUz4CZ2F82Q3awfVyIsnAf:2R98mzk1yPZgUXLRwpX2W2caKvb
TLSH
T1F352D82ABE10397B9CCBD32AF922BB57D3F5102921942E90E7FC992C25E76CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3c73b01fd8b2dc9aaee832ce800036191f52e5e2905a3bd95defc5134e89f6b3
MD5 20f1b0d9e118b6c5ce87930512894647
SHA1 8973c03b492e4a0f751d30e027cc528f860b3ef8
SHA512 aafd3592f275327d6f767cbfabf123fe00c902ded8a6e8b0291fd9b46d90d410b78a989f87b9932ac68e6896eadc1445697f39e8640cfd3d9df4550da8ab36cc
SSDEEP 192:2R98cBzQGkXYc4Hv7lpupZPRp9ZKJW0h9fHsb+WNV0hUz4CZ2482Q3aw7VyIsnAf:2R98mzQ1yPZgvXkRwpX252casvb
TLSH
T1F552D82ABE10297B9CCBD329F822BB57D3F5103925942E94E7FC992C29E76CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 71ee7d3405b2c8a2b6537ea650615b0ac91359d28d9293b893e66359d1b174ba
MD5 befbf5ab93d84ed6f5edf4564959a5d2
SHA1 78c2290272fe0864807d17474a95fd6a145696be
SHA512 c849775b16683d36f5219533f46f4449a317b8848ac9c968c0186d19619e63892526fe3ed781ca3151aa007a6734ed52079df210c141ca6c6711e485f87b131d
SSDEEP 192:2R91cBzQGkXYc4Hv7lpupZPRp9ZKJW0h9fHsb+WNV0hUz4CZ2482Q3aw7VyIsnAf:2R91mzQ1yPZgvXkRwpX252casvb
TLSH
T1E752D82ABE10297B9CCBD329F822BB57D3F5103925942E94E7FC992C29E76CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b34593a46dea4d7eadde882c2413f5b947a0bb008a8d0caf93d0d575d2bbef31
MD5 feaef4e6f545ce71c8e60a898f510002
SHA1 487e3aa67d78b48a0eb9fb29060ebda1e1b2a4c7
SHA512 d7aa8148f69d142aef9856ec37777c1490d608576194b9ca81d453baaaed975b43bbc971836eb0530c0ba13cd6a7947f56ce21b3886071271aaa8b5df587a9a8
TLSH
T15AB01211C0419901C45303F0154A54C871346F20A60B1B0543E06E22D8292A180140A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5875d7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5875d7.TMP
Size 96B
SHA256 25e7ab841c5448d7ff2f8a9e637630825085547aa5a2512138f81fd3a860f2e9
MD5 f588bb67449ec3b6cff10940f198ebba
SHA1 6c0a1a99b75a181bf8750ca5c935e9119b426b6b
SHA512 871c0442c8602ce9c5cec7516c03a43d9e60c683d4556e00dd0f6f065669d3859e86d6b78c7db647fbe7db52c16879eef00b41d6b1f61c78e16522c16862f7b7
TLSH
T134B00277C5126212C08213B065A595D8B265DF25C6035352A2E15BA7DC2967189A61B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 132283a8c0345275ee1bb7af2b554bc1f1881c47a11c45626e409a5bdf759280
MD5 8045202180553a548ca7147bec2ca23d
SHA1 1b2271ffe965ef728a7a5ce60915eba5f59e2927
SHA512 1c3e2e7d2d766e1b280af4fc55c83a78902ce3580942597402fa4de828c34c39528438523073b47d60691d40500c13302a9c2c4f1b0563c04fcbc7157e9290a1
TLSH
T1A2B0025945704D33CA9C43B05FEB5EE477230C992387E16240F55496E4653639392602
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a7b8c88ec41dca153ae17ed08a2d2d88a15d57c8da7ca696d1f2a1a16f9b2e8f
MD5 832aef7587dacd9ec88639636630c96e
SHA1 765417540e7a2221b00afdfa098cec530e80d82f
SHA512 5cce0ff8558e5c952f26ee5f7b65f0fa51ccef3cb18cdcbd47687e16f611b7ea665a1a97ce3760e642f27afc11bf481988adb05a6d5ca709387532549f9f91cc
SSDEEP 1536:gcWueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:nZDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T15CC31222CEAACE9BD4E46C7990C117F3BEAD4F9537F1B9028166A4523DCE7442391770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e065f2217fc9adec75d4351ed822276d1a613702c08f7b63656f5d18bae3dfc9
MD5 4178180c106f4987f1881fed5fb8ed5d
SHA1 6ac2d28a7eddb13095d175bccad049abdac75ef1
SHA512 94384dcc65731d37a10edee3056b032a8c2fe4d653b136b07fb351cd22640838c547e141ec53eac8d0b5cfcbfef55ac61b30b7b54d02149fc1d7abfe4169499a
SSDEEP 1536:gJjueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:OSDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T15EC31222CEAACE9BD4E46C7990C117F3BEAD4F9537F1B9028166A8523DCE7442391770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 988b69a5f836d89a67e7703d1fa75d7eb9a3c826e96536cff1f01993c82c131a
MD5 c7006aac0cc51f13fba1ef1c42bcb559
SHA1 d46f8ef9ccc801f3f11f936b06dafdd876f54a40
SHA512 fd48908ed626df881736f5dd4862b449e3be35bbd7b2145c23daeca406b97a7131496455b9cd59b82e66125e975770bb1596664550294a9821936d2e621a52f6
SSDEEP 1536:nRueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:YDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T145B30212CAAACE9BE4A45C79A4C413F3BEBE5F9523F1BA424166E4023DCE7042391770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 647b77e6f27908cc5706f1083b4a4fca87ad1f221907edf68c823d89d378f2e0
MD5 eeab1e67e1a8a1e58ebfdc45c07bbe13
SHA1 0a419578a52ddfe45fb980ec0eef44c559f38d00
SHA512 756d95f09ae857dde633b131bdb193e5324c64d193fc8c4b4f380545264f3a4f18879dabad634f1bcb4c42f79ef02db8a8afa674175156e28009f8ae19c5be59
SSDEEP 1536:gbIueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:WjDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T1D5C31212CEAACEABE4A45C79E0C413F3BEBD5F9523F1B9424166A4523DCE7042395730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 11c360d17f7a14147f5350e75119f165ef24abb649aad0626b11944de1d22065
MD5 4bc00992fc612525332f6fcb3c8af04a
SHA1 d0d52d296b0027ed8bd18673e0112762729de3e8
SHA512 87f948957c3d09ecf268ebb27e7bf431bbba2cc3df2f38fd0bf1fba8d5c1c58a8cac460890fe529d21648e5dd3c3b39798a2c21a024bd90bf40cddeabca47e02
SSDEEP 1536:BkIueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:ejDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T16AC31212CEAACEABE4A45C79E0C413F3BEBD5F9523F1BA424166A4523DCE7042395730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\MVPLoader\MSVCP140.dll
Size 558KB
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
SSDEEP 12288:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pdd+cOj6LbndDrUw2K1fQEKZm+jWodEEVJaP:CEtmrdcK1fQEKZm+jWodEEb
TLSH
T1FCC40927B74D02A0E195A3B861C34305D7F1BC4A8312A3C752FAD66E2F6B7D5673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MVPLoader.exe

Path C:\Users\Admin\AppData\Local\MVPLoader\MVPLoader.exe
Size 343KB
SHA256 f043b031afa72f3d012fe9134c8f7c791ef5fed6ea8a425ff83fda6e3475d6d3
MD5 60ca162fe186b4ea12a3d199f05d6fe6
SHA1 30677dff99f4866aa34ee6b498bf638251d70b8e
SHA512 4dfa09d27ccfdcb9830ebeef239c7dc56890f6b593dda5385968bf11c7de43cc1fda37029618260be821b8c4de02a24844a0ceb5f923e87c91a84289d6b12c3f
SSDEEP 3072:w/iKLGci8BfgjZlXgS7VV0kJku92zim5SQ3j9Tput/Y0ldez0GM0WA:w/iK9i8BU5gS7VV0kJkuAz9/RgzlQ2
TLSH
T1E074B58D210601A7F01744BAFA18AE5D92633FB84F0A83CF6D723F9B2E7B3995C64551
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Users\Admin\AppData\Local\MVPLoader\data\app.so
Size 7.1MB
SHA256 880914ddb60619e35cfad681663346c661c35267472f1f3c7aded39acedd9b32
MD5 a568f44f6f9a3757a4f0733d3c513f69
SHA1 978dab961a3c61a8e34c3ca5f56e95f745c7440d
SHA512 befdfc2003f3538d8a7e7d65fa777424a66b26beec04d0b7d0b07321e387838f0d0493a2e674c3653dc9d05c8cce4210c5bdefdd9722c5c7f85338f99d2fcf32
SSDEEP 49152:ZDzqdnQO822XeJs5EU68H3Oh9nBq4+DCdMeArdmz4H3wPaKJbjbl9VmOJcAY7PHj:Z4BCY7p4XwP1fbeFj
TLSH
T113764C5FD0D45350C422F2B1F79E67BAA61C78984B34A1870AD84BB63F97DA04BCE172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontManifest.json

Path C:\Users\Admin\AppData\Local\MVPLoader\data\flutter_assets\FontManifest.json
Size 1KB
SHA256 15f38778b5d83346b9f39c56aa84ce67c39eaedc81dc3729f9d86ec0f4445043
MD5 a11459cbab6a84de2276887afc69813e
SHA1 4a1ac4478a354dadaf6600dd96f9bfae041a96f3
SHA512 92f019117c9c1686d21d203018d8311fa7e5aabd2d8590866c74227aba16aa3e05d2354d6de1c64e5c3b938f5df4a4fe7b9945d80824533533f5c366f0fa8763
TLSH
T1EC31C50F951505E455CCD5DBF07322933849270A7699FC9AE3BA1FE8E2B025523317AB
MD5 SHA1 SHA512 TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\MVPLoader\data\icudtl.dat
Size 760KB
SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
MD5 692337664e861ad322138061132dddc6
SHA1 8a99bc860eda0772f3b1f4a125fa4d474410e21c
SHA512 3e2e6adb651e37e530734f999634d7c101fa1c45ae380be8ad169bbfb0a047f2878ff6c8d1428d6b9e7301b447ab2f8839484322ddb3831984be71d442829a55
SSDEEP 12288:HMlhw771h0jM7ykPG07+r4c8w0P4N48RkjtYdPHz982VT50q:ahw3zVtjsbGu4RjgPHzfCq
TLSH
T18CF47C03B1D79C9FE0D48636C9A1E37A9A33978C5B7311D67E6D45887F4A0D70282BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_rpc_plugin.dll

Path C:\Users\Admin\AppData\Local\MVPLoader\discord_rpc_plugin.dll
Size 69KB
SHA256 9a40261138c8faca7941d73777556d58643f9091847fa91031a4f766c4480434
MD5 0cb9b3f39fc82ab1e5ef2d96e8837d31
SHA1 723044aabe9b6eb65042588e19d96a215dbfae9a
SHA512 8840da8e204d8bcda6cbfaab1bf3a1ffdbe4bbb48460b76368f8ff36e8ce8e58e18f86053ada9c33b5a5613a10f6778b41378031864ac484f5da5a2162f62c1d
SSDEEP 1536:umliVk0TzQiw9xPp1Kni3YVgS5guK1pwraXA67l7KgSZ:xMjzQi8h+AdXA67l7KgSZ
TLSH
T1F063286B779C00D9E16AE13D8A9B9A46D3B1B451172287CF17A0431F0F67BE41D3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_selector_windows_plugin.dll

Path C:\Users\Admin\AppData\Local\MVPLoader\file_selector_windows_plugin.dll
Size 103KB
SHA256 ea2281b0d86a3d26f4ca50830872d3fc0a581e9dfd9946295028f5101cf17aa0
MD5 7bf24da04a3f5c7968d13c5d3ba42889
SHA1 76a85746e6800377dd4a855bc0d964f307ab65bb
SHA512 54bac158a8d6dac29b0ccb5746836bb57137c60bf78183b65b383a6d5cec50c045327d57e00cb1c6fec72823e65e567b30b2e2f19a31208e36c3e86856325545
SSDEEP 3072:mDolCaBGXZpxi56sLS8Uqjs7xNaCwHsjpF:mDolCaBGRi56rks7xNaCwHsj/
TLSH
T1A2A34A2BB36C00FAD2AAE07C8A475A06D772B4450B21D7CF17A0435A1F6BBE41D3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\MVPLoader\flutter_windows.dll
Size 17.4MB
SHA256 3499c3f0ea5093f9db53eb40a7ce7d28d5d33d5ac449b03e6dbddab46fb2f894
MD5 6546d61e4c3a9b94d70c139a89a3abf1
SHA1 2fb5baf454eb10c3bb99575467d8b5fac609adbd
SHA512 ec0cad7c397e14e897b28d9a91e92dc8cc5866ef771f529c9c7eefb710b12b2ccb3cf65190161438ef1864b5a51b23aefa53b530cfd165d4d85796beb6f9c9c6
SSDEEP 98304:s1n13BAmZtFJpLs2kWCgz/kVq/JnMZ/4v7Wz8xwvKZzmpiUbALORuJwkRlwXYCqN:G7N6gz/MqU9mOkPqYl+e
TLSH
T1D1078D03F59680F9C08DE2789B5BA927F671B8490621B5DF278807163FA7BB05B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Users\Admin\AppData\Local\MVPLoader\url_launcher_windows_plugin.dll
Size 87KB
SHA256 fffa9c2d5b1cc44991962d8384f0e23a0ea102c3e59606bfd660679b48cb7864
MD5 e6d7ee265a357b0c48f17d2dc96ac295
SHA1 b0cd547447226fd68f97b8304826858f882f3e76
SHA512 10631319606248040d4182ec1b4aa2e1c45a6037d253bb644c5a9a1d8169a297c6a8a92fe99a9258b921592c834415beae62e9795cbd6f86d0e39324501ce9c2
SSDEEP 1536:J+cejicYQ47D/mjixM7Hwthvi4Pi+lUCgdm7V7V0ahZhQedg708y8E9s97Vmocic:J+L47jmqM7khvictgdm7V7V0ahZhQedr
TLSH
T16E93382B736D00E9E16AE1BD8A5B5E11D372F8491B2283CF03A0835E1F77BE51D7A650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\MVPLoader\vcruntime140.dll
Size 94KB
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
SSDEEP 1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
TLSH
T14C936B4A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6866A5F67BE05E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\MVPLoader\vcruntime140_1.dll
Size 36KB
SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
MD5 7667b0883de4667ec87c3b75bed84d84
SHA1 e6f6df83e813ed8252614a46a5892c4856df1f58
SHA512 968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74
SSDEEP 384:5InvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbmuncS74GdWrUKWj14gHg:dCm5yhUcwrHY/ntTxT6ovR7VxIV1z
TLSH
T172F24A8167788096E46B95B0C4A35F27FB38F9616750938F0BA4825D2F637D0F63E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 aee75a44617f4d074d7e1787c03a2b5e0d20e57fbe18e967bd432e0290141c8c
MD5 bef1aa8eefc3a1f9b30710f8e46a86e6
SHA1 eb73d2c069cfca986a5d8b8c9f427be7031bbf5d
SHA512 70f2840829cb47f276e5961afe85282b4043783935bc10f9c5840491444d8156c5a3e9888cfd06b1bb0e61beec70fdc8eae4f59623a69a4ad89788c3862e017e
SSDEEP 192:sxZVRJyMqZjK1Ml8MNd/f7s9Pa8KTG5GN2Swbzodpwq/W6+WNci3/Y0hlL+DIgjL:sxZVC1d/f7s9Pa8Uei2uX/bN/57yj+C
TLSH
T1BE62E7066B64997BCCDBD319FA45BB53D6F55563A1804E489AFCCA1C04E6AEC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 b5cdb11b466913a85dcc64f83e8b051824e34245b58ebacf2b8ec8996da15a36
MD5 8d5197170fdc784fa1d033272ebd7612
SHA1 aa52cfe4dc8659557ea25d6fe599e8180da77752
SHA512 c74a6c205fb93a609b10afa921943e2cd0203b4dde596a90f004784b31b894c7917154d43e764b71311a22afd224416c215c5c92543870b04daf4b75ab2a742d
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Tzx4LlL:wQAKq8y02yqEnjbWRmj1QWTu1jaKTzxo
TLSH
T14E03FA3B6C0CCB7E4FC04E9CED277E8A6DE8028BA698895447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 35123df906874dda56bdf0e56a22997ddb09cb00336e0ff83f81b48aae86ac3a
MD5 2cd0930cabf11d2348da866028bc797d
SHA1 0a4bf240521070f21c4d073a9ce0f170b7731889
SHA512 32a2258228b551cf05840ce4e4a5839e2dc000fce8704200ca75dbcf44c44c8c3bd54edd9fd3734ce8c22a98e498ae35a8043f8e35fcbfc3cb2e794baa863476
SSDEEP 384:nNiF9CcmyWCs38Nj8TUNTUlIRuPm3ek32nn9VX64JfbgGOSeFoYENn1h33yc0jtd:EFccps3wwgIKekmLuGOxFobn33yc0T
TLSH
T1E8B23931E855CEBBECEA4EDAF75A3643DEE0116398888EE8DAD80D5C00971DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0adbb1a97ac02325bc1e0143e1ed4a12c6061231c35f548e60ae70c8172397aa
MD5 30852cc3983fc03cbfd3c436b5019377
SHA1 37390be73557fc29f1d04e016293eac72ca2c31d
SHA512 9ae772cc6004377be50c71377730a433115fba621e40b1a7ca55ecbc486d655fb68fba78cc1c3f2945a0f6298223ef94e2e6b3bd859a912d98964810496410a0
SSDEEP 384:n0iF9CcmyWCs38Nn8TUNTUlIxBPm3ek32nn9XGb4JfbgGOSeFoYENn1h33e4KV8R:PFccps3AwgPKekm4ZGOxFobn33I8p0I
TLSH
T123C24A31E855CEBBECDA4F99B74A3642DEE01263898C8EE4EAD81D5C00971DD170FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 fb4a03e24baf7476b257be5a369481e2dd63d814b77473a3cf71658cb00cd756
MD5 578b546780c792206333436de96b08cb
SHA1 ed65b7f16c7f4483c8c192daa6cf3b00e63206f2
SHA512 84b50cd80e0fc795560dba406e01a1a01b51e2b9207a46e5e2d8d36bc7b2a5a6de301f3471beb2184f8f0048b2a3241bf1791f0e9a08b89f2787bb2cc36af3d6
SSDEEP 384:nAiF9CcmyWCs38Na8TUNTUlIxBPm3ek32nn9BtQos4JfbgGOSeFoYENnVue4KV8R:bFccps3RwgPKekmlfsGOxFobnVuI8p0I
TLSH
T15CC25A32EC58CAFBECDA0F99E74E7A07DEE0526385984AE4DAD81D5D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ead17c554a26f581385df184c8f3bb5803a5cd91bfed04e6e780f9dc3331f953
MD5 eff51b59ba2baaf72e7de7b66beb961c
SHA1 257941e49a63241957452077c282daaa47d9a897
SHA512 b214a759d92927d1ccd7183c50803becc2509927251ef0b4e51056ea6b7cd84d2d14d80be5cf5103fe8d34e0eb13e911e7fa01d680995fc6bc3eb6051cf3dc11
TLSH
T15021AB33B7ACC1B5C8C911BA1088AD01B2B6C3C7449ECECB7B84C508E57F999DF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6549456695c046fb7780092238b5dd986bb686e6626770f998107607d8a16f91
MD5 c4931b3f4f21302b0939015e816430c2
SHA1 b390f654221b8cfb0f0d1eb10ff0004549a9490a
SHA512 d72e50ac5b23df0b46e07bb7da440af4a16b966a74e7dee4bf4eaa6629c9d31d09d2c896fecb1abd25959be99096422a8b372035528b06a5ebc34a18e6fb370a
TLSH
T14B218933B39CC134C8D9117A108CAD01B2B5C3C7449ECE9B7B84C508A57F899DB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 62fb29c2f53d6286f2f2fe0c3501601a5e4595d238d24426fcc3a70d52596f0c
MD5 234a725c27ec075782466d73844cc9c9
SHA1 95449e6f1b9e5dbea3e70742dfc39e292198a0bc
SHA512 1169dfa7cf933fc48c6d40b499aa91a8d9129cd1397b3c39ced983d598761dd25fd27e69c3e5c2ab5d828f94f1db5d761e44be2e066b9db538e854d198587029
TLSH
T1CE218633B79CC134C8D911BA108DAD01B2B5C3C7449ECE9B7B84C528A5BF89ADE681A4
MD5 SHA1 SHA512 TLSH

Submit Download

60d50f5b483ddbeff59c78c7b7a3f4d6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\thumbnails\60d50f5b483ddbeff59c78c7b7a3f4d6
Size 15KB
SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
MD5 af80a936c10e18de168538a0722d6319
SHA1 9b1c84a1cf7330a698c89b9d7f33b17b4ba35536
SHA512 9a1325c8ce05806e5c161a4cf47239f62baad8f79650fbd713e74928fce8171ced10ba7f24fac46c548e1dbf3f64106270cb25ca88c836c870107f5dc1f97879
SSDEEP 384:XJ9H3UgBY5QpDWZoc94ukwZ8UI9wujvkJL:XJWn5SWNVnI2/t
TLSH
T14862AE03295E87F5984CD6DABD8307AA6F69392EE8E2722E465B0C8738507714F4E07D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexPackSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
Size 10.1MB
SHA256 0e03c09769712d4c511f7edc175301eb2b968740f861e7d827eacedf1ad8d1bb
MD5 a5e7355eaf15c79fb3f1a24194a64bd1
SHA1 acff13db5471550639bcc356f265a20afa9dd868
SHA512 8295a2ba520510c20e110793819e89c96574361aa4250f0a99c933f7c0a6e9ef76b4c9ad2afe52f69e22815732e086b99c7c65afbff408a240f509d14f7121b9
SSDEEP 196608:mdad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:aadCoXrlAJ7N3pXW2uGzy
TLSH
T1F6B6D001B752C0B1EAD101B116BE9BBA487D9E144B3189C797C43E3DD9322E2673BF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexSearch00000.log

Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
Size 1KB
SHA256 688b8916438c02af333f092ea422b7bbc6246171ab17152162fd5a4b13f46b6d
MD5 1e0934aa00f8522b82f1f14ecfecf4d8
SHA1 ec02d431188be8ec048814803cccbea9c72c752c
SHA512 aff0e3482439b0fbe9388b015fe633b8ef49a6f5eab6f7fd02621d1e19b7303bb2e6ecf9365b848edeed43a447adf60e448db2ec2c1e021c069e5605990ce5ae
TLSH
T1504115746EE94A16F2B6A707BFF3C0525A33BCC56834870C22C58759066BD05A8BD37A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dsdu1hxf.hws.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dsdu1hxf.hws.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

omnija-20260202.zip

Path C:\Users\Admin\AppData\Local\Temp\omnija-20260202.zip
Size 27.4MB
SHA256 4ff629a5b022a37b1bf32e5cf558fbe03a3873c5bf6ce3a3d31742e74d04c208
MD5 b86f64d9d75454039fb2e1240448769d
SHA1 4e901269907d9783aac6a1b64c2a00fd5c7c697a
SHA512 61c57ea5c15e8cdf2402c846cb2154a13cd2e1ac667bb05841bed15a3e2513041e4de515c608b99b61ad1bdcc03037421797f57f0eceb731fc4bccf8befa7407
SSDEEP 98304:GsHE6AKr4JCwEnjKq3EOriDGAIGPEJUgCmubWaJEc3yQBT90oBXborXm9:d4JCwsuqUOrFAIGPEJUvyarOsXX9
TLSH
T179574B59A3F9157285536179AF6F6041B331801B2909FC187E9C839C3F8D93E81FABE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vendor00000.xml

Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
Size 510B
SHA256 5dd436b47d7ae7167ddda8819ffd20db1ffd0f93c6681ae51878000b0431a3e3
MD5 d0b9e34afbcd2b5c8bce3f8caedef630
SHA1 7c159e7489dffa4b20adb710b0c6921cc9ccb23b
SHA512 170e7b480beb889a3108daca8efab813acd4bafc3dde9c28d0d3c7f838f10d448129a4daed456dfee8d4cfa0b742c299eb408c58ee08f1ad10dfa84ee2b50a3f
TLSH
T1F6F0C204578FE925B7F24712813D96D9D6C9FC94C1AE2F8CB569E320948A23A0F7D330
MD5 SHA1 SHA512 TLSH

Submit Download

YandexSearch.msi

Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
Size 9.8MB
SHA256 21ba4c431c07a262578c7ea51d915cd1c614cdb2443c9062de780ea8a1c3ddb1
MD5 09da2e69ed5bc08d6499f14ca5fd0396
SHA1 0c526830ffbfe5c5b9ef60816520cfa4dca7f7c1
SHA512 7effda5361027da065c6c936e150029aafda85550fb62e2e2ffd0c2de5d5829db6218b432a5cc60232630ff0280e4f8524d640c41f893cf160799c7c99ca417c
SSDEEP 196608:Odad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvqG:CadCoXrlAJ7N3pXW2uGzyG
TLSH
T13DA6D101B752C1B1EAC101B116BE5BBE487D9E148B318DC797C42E7DD9322E2673BB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9619275B-962C-46FB-891A-80E5D6E498ED}.exe

Path C:\Users\Admin\AppData\Local\Temp\{9619275B-962C-46FB-891A-80E5D6E498ED}.exe
Size 6.9MB
SHA256 f9bd4545b391f0a524efbc7127059b91c0e6dd7fcacdaa3e5667ceb95a943892
MD5 a868dc2bcfa046b803cef859f9e84924
SHA1 e12e179b3887145d44b769543a69af3aaa4205a9
SHA512 88b2119f15758451f6d2855df980d2ff1f95fe4791ad915d5e15eb26344da333399610edb0072989dbb6252b05b2babe42152f64a6f07e3bb3015417a3499450
SSDEEP 98304:b6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwy:Fhm3pKXxFaItji
TLSH
T1DC76AE8B4A45307ADC196E71162D2CEB9119E4C94B304FDBEBE95CE456B16C32C3A3CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloader.exe

Path C:\Users\Admin\AppData\Local\downloader.exe
Size 203KB
SHA256 c60c3a7d20b575fdeeb723e12a11c2602e73329dc413fc6d88f72e6f87e38b49
MD5 b9314504e592d42cb36534415a62b3af
SHA1 059d2776f68bcc4d074619a3614a163d37df8b62
SHA512 e50adb690e2f6767001031e83f40cc067c9351d466051e45a40a9e7ff49049e35609f1e70dd7bb4a4721a112479f79090decca6896deac2680e7d107e3355dae
SSDEEP 3072:IWF1Sss2XaOvu+v7QC2mCAbtoJOBW0rArwrkut57cIrDjy6Hy2BKbY64IrHLzMxI:IWF0+XaOvuyycWNrwrk6y2ZJIrrzr
TLSH
T1DF147C2175C0C432D1B3193059F5E2B02ABCBA700F758A8FA3985B3D5FB45C26626BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 936b6c316646ffc306842631d5b4afce436810dc4feeda41e45cb886d7035958
MD5 b27bcdb54e899f423a308ec95e7143af
SHA1 d8ff4154512f023611f4bc61d314e452490c20cd
SHA512 47cab0e7a9a6a6b34e5209d62b46890b24c8d4caacc34f4f791387e1618a577d8b7740e817f67ed3240597e28e7d2e58ac001641feb6bb6b3f2b90fbb866ea21
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5b77241a7357a09b28b1c6569a6528c1b1b120e7b251abb21b87123ed07d1402
MD5 0f44756fba1a5fdcaeae81a1d8e86f57
SHA1 4895bdcdb933497fc6e45d674782d631919c1e66
SHA512 d593eb30f1e98e33636c5dbe7a168fff5ba04662e24fddf5a868832d30c8b44c989f38127454a60556cdfe89815ec0cf3dc07df9acdf7342bd412effec7a274e
TLSH
T1DED0121776010D3CD4102433111361083800C50B408ED008582E991D1B540700D07481
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 c8a1ea18fe9df146e8ac515227bdf398ffcd67274b4d051a6710510f75b0d7f8
MD5 a35d14889fdf1844a181a9bc66dc734e
SHA1 208878cb5a9ee12f525e496ad9d34c03b4284edc
SHA512 3f2257d65e95fa5880ab60107530c39336d1371807b2ec9b4d232e2d9978d3f4ba36a6765022cdda98980552ee7401fb468c0944281554fd1d15ac4673a3f62c
TLSH
T1C4B001307EE69082CB6D9E74E89646413262CC5C95AA0B8282F406A989EA38055C518A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596a2a.TMP

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe596a2a.TMP
Size 48B
SHA256 a2f2a8baa46bc6ae2fdb8014762819d0f1ee2c11da44de04c4d261ff9b4a2353
MD5 13ad67b4f641d12558eac9377567ff76
SHA1 53ede8a8ccecb623edaf1b4dcbf0b5a7fd04e452
SHA512 040ed107263ffed49f1cba4177523d0b83a2c35675d2d90204fd3c1997c933d10a68bcce36f7c8496b43c5bd6c240e27b07edab350577975ae2db2bcbbcf1b02
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 5491997b60589804e908a7fe8222f08a409d294bff26e8a4e241904cdee5f393
MD5 1dbeb2eb1275f552a6f016080fa8d26c
SHA1 54311c2fa7b8c7d8eeb6aad3121d016dee6540b1
SHA512 031695781e9c0b0d6e3a3fc3b2df03aca9755b008e794bec59c00a8f9569c0fca3375d34e7625c80a57deff633d90298c60b54ca98c4ae1d40fd714fead5896f
SSDEEP 96:stj05NESYb9SSaffqAZ8i0vhEckcDm/7qx+WVHMSm+uecSGljMdQjo+gDO4XKEB:stj0HXfnZ8paSy/S+WiQGlodlJrXK8
TLSH
T128E1BB02AF24A9774CC7E6197E35FB52E6F9106162C40E98EFFC456C04E66DC630794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe596a39.TMP

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Default\Preferences~RFe596a39.TMP
Size 6KB
SHA256 f6d65c082d888e27803aa32f66d0f54daa3a3c6a574ded03791a04effe03058f
MD5 11e5fc718ef653732f5faafac6b69eaf
SHA1 3ad0680a712b5a2f46e48be3c42418b114ab661f
SHA512 14ea3300e2dd23202e67bdbc79fa5ebb1a56b4b7d01d1cb8ceed6d6faa78f216d16bb39a8107225ff0599216f7c613b629f348a46cb0f2b06e96e67f44b71165
SSDEEP 96:stj05NESYb9SSaffsZ8i0vhEckcDm/7qx+WVHMSm+uecSWV1idQjo+gbLmMEB:stj0HXfkZ8paSy/S+WiQWVwdlBLmM8
TLSH
T12BD1AA02AF2879774CC7E6197A35FB16E2F6106162D40E98EBFC466C04E66DC230784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Local State
Size 16KB
SHA256 7d1344af871bc72db0105e13bb44dacae066d9d02d14eb35fb8a9ee062ea397c
MD5 0259233f6cd085f3bc3ff97f9c6a1331
SHA1 67d55d6358f2732d1cb5a8d123f5c16d6bf2ccab
SHA512 29faa2709051ddab8812a994ef96bf67a3d9fdb18760f7464636867a783a523a4277c16e5a45a97c12d69db7e3f508b982b755e9f95b7ab23614681a04514909
SSDEEP 384:zr+aQikB+z/xvxjg/qhEh3NbhMmTpbuGQ:2/UxvxjgC+hfZFuGQ
TLSH
T132729E2769A83D339DF3E9417A5D1B8FDAB55872C1C56EB80EE90F0E06C73981306D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Local State
Size 16KB
SHA256 415a9fdaa547f4642a5366a03b6686558c051fdc3fefc0ab055a12fced765206
MD5 bbd70345f792a9995cd5ec32c535d419
SHA1 2a3473fa82c749aca7416ef87dc03f7b56a96f85
SHA512 39b2a7a617247ff4a22301ad4763b2b35a5f4e4b60c01bde88354b3a33d7ad63d1e7c000d5f30f9b761e5a8b1a203da3cb683e3a65b98b6c397d3fd90195967b
SSDEEP 192:zNq7DFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4kENb43YBPooDUz:zg+aQikB+z/xvxjg/qhEwNbh1RTpbkGQ
TLSH
T163728E2765A83E339DF3E5417A4D1B8BDAB558B6D1C16FB80EE90F0E06D73981302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Local State
Size 1KB
SHA256 b008f48da50d4c8ee2053a68f95819db22e8caa884de29baca7e503488b5d4b1
MD5 9539190ce5a94274eca86887008f4026
SHA1 a68cb9964f3175bdb0ea05c6b1b133b2431e5357
SHA512 013f037d6e1c4309b9e3cd43532908b79bcc52341149ec36e79cc4a6cd2b0366c29fc51dc54b7aca2464fcd665873ecff468b9fe2b40b45b2f56432ed798c382
TLSH
T1F9318573BBA437325CA6664172467E471D31207AC2504F5871DD4F6C01F7A9C5576C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Local State
Size 2KB
SHA256 bb013d125940ede4e2fcd52c4fce58135e714fcb47ebcbfa58da4ef42c80cf1f
MD5 91eb30b639a86ecccb44e749d50d3436
SHA1 269de10b61d0490a69639def48d755e80e28e0d4
SHA512 a6358351be31d06f7082eee481b7d8ef240df828cc3a4a31ac787d45c437289936736555496aa11f0c1b513c6fc1f69085ac7b10b9e427894d27d54d335c0706
TLSH
T1CD51C7737E1867738DB35A04BA493F029A365175D7612F64AADD0B1C00E76AC2352C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Local State
Size 3KB
SHA256 53a6dae3ff571b60c9a9657a1a0fa02843ea941023ae7fa58dbc863e173eb527
MD5 fedf6d89c65ab033bd676ef89033e7cc
SHA1 d63c5c00b7b84c46e4dba631fd58af527360dd10
SHA512 88163cf70505f4dc8bcbe2ff59754e0f3eec351c573ff8b162e6577d5fb6254b66758d670a99291d83af177a99f8808f36bf71d28dddae08cc94377d833ee9f4
TLSH
T1FE71A5327A64A6374DF39A00B9853F0676661137D6953FA8DAEC0F1C01E77E82352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5925be.TMP

Path C:\Users\Admin\AppData\Roaming\MVPInstaller.exe\EBWebView\Local State~RFe5925be.TMP
Size 1KB
SHA256 3e49cfd63b3e2f830f40723d3d21e08d46a035b65567ddedd3fc7b8d188b6701
MD5 f7cb1cb24474d4414bc6d765fec18847
SHA1 f1a5bf36e38b4a546edaf570875fcd10ee2f163b
SHA512 00a91c0a91bdd73d3ba1f196e6c651148556aa737752945f3673e6a3c3a413909ab66769fc8908106213c3d3a54808a59ec4aea142a82f52d8956d69ca864884
TLSH
T11B21B473EAA837326CB61901B306BF4B1D20207AC2104F1CA1CD4B1C02F7AAC4272C37
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite-20260802150320.720397.backup

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mrc4wp7b.Admin\places.sqlite-20260802150320.720397.backup
Size 68KB
SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
MD5 314cb7ffb31e3cc676847e03108378ba
SHA1 3667d2ade77624e79d9efa08a2f1d33104ac6343
SHA512 dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5
SSDEEP 48:TV6UcMtYJqqEgbEwq3hF+gBNxw2BAl7FdickdaxL5HoVQJlu:x6HkTBB2ljvoS0
TLSH
T19363DD5B1A343122D8EA90737EE2506E093CF13A8F6776513DF010A6CCA1D62E5799FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MVPInstaller.zip

Path C:\Users\Admin\Downloads\MVPInstaller.zip
Size 4.5MB
SHA256 b9545c77a1f9fb1055189c4f31a0222ac77ebab8ee40981ff99af08c4a7d08ef
MD5 05c5c368b790aef9bf75006964f3960c
SHA1 78b60450df2c9213061621408e34395ac3d65cbc
SHA512 817126b602f20334672317e11e6f567133ca4ba8efb07594b6f150cd20d6066ef27dbeea95769786dc3cae58c5c7d190af882d2633638f859674695e014366e0
SSDEEP 98304:W0rHAeTY4hB/ywHVrISSJLZ2O+IzjxWGgha2Rau4Bfq0r6QS:W3eTJbywVCLYGVWGz2RanIn
TLSH
T1D026334D4E126C3089D08BD5EBC670BA8A783397B574F4F68CD96BA3119F9C3C7A6508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MVPInstaller.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\MVPInstaller.zip:Zone.Identifier
Size 120B
SHA256 e17e10351fca395821f9561d773e643b26799869acfa90a1976daeef55e13187
MD5 b8e0e92b2d5ec183d078069bc6905b42
SHA1 9b3d4d35a4f24e35fa5a5ab21a0f8cd82ab8eb5f
SHA512 b02c18f2a689e09fb6e911eed61116268785b73ab4984bd6f6b0a0032082958a45be8da1c43b7bd031dad89bcf3a8a2b2393874a975762400e9cf74a648a9da4
TLSH
T19BB092970448C0102602A3E891ADBD3DA10B2517CA528AEAF94058AEEDC44AFD5E3613
MD5 SHA1 SHA512 TLSH

Submit Download

MSI90E0.tmp

Path C:\Windows\Installer\MSI90E0.tmp
Size 181KB
SHA256 a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
MD5 0c80a997d37d930e7317d6dac8bb7ae1
SHA1 018f13dfa43e103801a69a20b1fab0d609ace8a5
SHA512 fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5
SSDEEP 3072:LIgxsEwKIE4SaX1xQrlm4taQqPvvNCqv8bcDR0wYyMP3XrZ+bx0PWWX+xA6QpS:LIgxsEbIE45ArptaQqPtCG8SR0waB7Bo
TLSH
T1DE048D127180C075E6FB1A3C4578DAB65A3E79305B74C8DB63948E2B2E702C1AF35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2868-7352-0x000001D656AD0000-0x000001D656B83000-memory.dmp

Download

memory/3484-376-0x00007FFD0DAA0000-0x00007FFD0DAA1000-memory.dmp

Download

memory/4104-271-0x00007FFD0DAA0000-0x00007FFD0DAA1000-memory.dmp

Download

memory/4104-552-0x000001C6B2C70000-0x000001C6B2D5A000-memory.dmp

Download

memory/5000-547-0x000001FE67C90000-0x000001FE683A9000-memory.dmp

Download

memory/5000-549-0x000001FE67BA0000-0x000001FE67BA1000-memory.dmp

Download

memory/5000-545-0x000001FE67B90000-0x000001FE67B91000-memory.dmp

Download

memory/5000-548-0x000001FE67C90000-0x000001FE683A9000-memory.dmp

Download

memory/5000-546-0x000001FE67C90000-0x000001FE683A9000-memory.dmp

Download

memory/5548-576-0x000001D61E9D0000-0x000001D61EA83000-memory.dmp

Download

memory/5548-575-0x000001D61E9B0000-0x000001D61E9CC000-memory.dmp

Download

memory/5548-568-0x000001D606700000-0x000001D606722000-memory.dmp

Download

memory/5548-585-0x000001D61EA90000-0x000001D61EA9A000-memory.dmp

Download

memory/5548-592-0x000001D61EAB0000-0x000001D61EAB8000-memory.dmp

Download

memory/5548-586-0x000001D61EAC0000-0x000001D61EADC000-memory.dmp

Download

memory/5548-587-0x000001D61EAA0000-0x000001D61EAAA000-memory.dmp

Download

memory/5548-588-0x000001D61EB00000-0x000001D61EB1A000-memory.dmp

Download

memory/5548-594-0x000001D61EAF0000-0x000001D61EAFA000-memory.dmp

Download

memory/5548-593-0x000001D61EAE0000-0x000001D61EAE6000-memory.dmp

Download