hijackloader | 74a1e4dead91d597b2474e157272794d0c43c877d79565b3ce306331f0bfe8b0

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_bc1ca24e94b383cc9d341e4e3e88bae3_elex_wannacry.exe
Size 12.7MB
Sample260820-3f196sxdlf
SHA256 74a1e4dead91d597b2474e157272794d0c43c877d79565b3ce306331f0bfe8b0
MD5 bc1ca24e94b383cc9d341e4e3e88bae3
SHA1 3af49cdb64729c8be2d1ac10aa7106f0492e20d6
SHA512 48f6bb762da740621381b261b6741856b8ad39058b65f0b902b8bb2abff769c0310c12e02674dcfc747751a80364964fa0dd6a7062896dc702dc3e93594dbc16
SSDEEP 393216:+pwU9vgFyZtgHKGy96ys1Jf/3HviCHDn1ASXMyq/s:ewuIgwq4J3/iCHRAgtq/s
TLSH
T1A5D63360739578F8C322903AEF0DE35966F6E3A02B014E9A3BCF1D265E571B1494F4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

e4d12643d44b0f664cb095b3db1c2aa6 credential_access discovery hijackloader vidar loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\NVIservice_iot
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

vidar

Version

Botnet

e4d12643d44b0f664cb095b3db1c2aa6

https://62.238.46.160
https://telegram.me/m1duus
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=YmbK
https://steamcommunity.com/profiles/76561198657426610

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5ac-27.dat	family_hijackloader
behavioral2/files/0x000c00000001c5c6-70.dat	family_hijackloader

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/2896-111-0x00007FF727D40000-0x00007FF727FA9000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 3 IoCs

pid	Process
3264	Runner_Cor.exe
3652	Runner_Cor.exe
1692	Runner_Cor.exe

Loads dropped DLL 10 IoCs

pid	Process
3264	Runner_Cor.exe
3264	Runner_Cor.exe
3652	Runner_Cor.exe
3652	Runner_Cor.exe
1692	Runner_Cor.exe
1692	Runner_Cor.exe
2896	XRegistry.exe
5184	OrbitR.exe
1572	memu.exe
4528	memu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini	OrbitR.exe
File opened for modification	C:\Program Files\desktop.ini	OrbitR.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2896	XRegistry.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 3652 set thread context of 2896	3652	Runner_Cor.exe	93
PID 1692 set thread context of 5184	1692	Runner_Cor.exe	94
PID 3652 set thread context of 1572	3652	Runner_Cor.exe	95
PID 1692 set thread context of 4528	1692	Runner_Cor.exe	96
PID 5184 set thread context of 236	5184	OrbitR.exe	101
PID 5184 set thread context of 5784	5184	OrbitR.exe	131
PID 5184 set thread context of 236	5184	OrbitR.exe	101
PID 5184 set thread context of 2984	5184	OrbitR.exe	138

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.Primitives.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\am_MASCULINE.pak	OrbitR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\el_NEUTER.pak	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.UnmanagedMemoryStream.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.Calendars.dll	OrbitR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\he_FEMININE.pak	OrbitR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sw_MASCULINE.pak	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fil-PH\tipresx.dll.mui	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll	OrbitR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-BR_FEMININE.pak	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md	OrbitR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md	OrbitR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\af-ZA\tipresx.dll.mui	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\iwa-key-distribution.pb	OrbitR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Input.Manipulations.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ur_FEMININE.pak	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Data.DataSetExtensions.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Dynamic.Runtime.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.Lightweight.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Forms.Primitives.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\UIAutomationProvider.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\kk-KZ\tipresx.dll.mui	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Controls.Ribbon.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\WindowsFormsIntegration.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif	OrbitR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties	OrbitR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\external_extensions.json	OrbitR.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XmlSerializer.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll	OrbitR.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\corerunner.job	memu.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_bc1ca24e94b383cc9d341e4e3e88bae3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrbitR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3060	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317421981293748"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5184	OrbitR.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3264	Runner_Cor.exe
3652	Runner_Cor.exe
3652	Runner_Cor.exe
3652	Runner_Cor.exe
3652	Runner_Cor.exe
1692	Runner_Cor.exe
1692	Runner_Cor.exe
1692	Runner_Cor.exe
1692	Runner_Cor.exe
2896	XRegistry.exe
2896	XRegistry.exe
2896	XRegistry.exe
2896	XRegistry.exe
2896	XRegistry.exe
2896	XRegistry.exe
1572	memu.exe
1572	memu.exe
1572	memu.exe
1572	memu.exe
1572	memu.exe
1572	memu.exe
1572	memu.exe
1572	memu.exe
4528	memu.exe
4528	memu.exe
4528	memu.exe
4528	memu.exe
4528	memu.exe
4528	memu.exe
4528	memu.exe
4528	memu.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
236	chrome.exe
236	chrome.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe
5184	OrbitR.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5184	OrbitR.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3652	Runner_Cor.exe
1692	Runner_Cor.exe
3652	Runner_Cor.exe
1692	Runner_Cor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeDebugPrivilege	5184	OrbitR.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 3264	5556	2026-08-20_bc1ca24e94b383cc9d341e4e3e88bae3_elex_wannacry.exe	89
PID 3264 wrote to memory of 3652	3264	Runner_Cor.exe	90
PID 3652 wrote to memory of 1692	3652	Runner_Cor.exe	92
PID 3652 wrote to memory of 2896	3652	Runner_Cor.exe	93
PID 3652 wrote to memory of 2896	3652	Runner_Cor.exe	93
PID 1692 wrote to memory of 5184	1692	Runner_Cor.exe	94
PID 3652 wrote to memory of 1572	3652	Runner_Cor.exe	95
PID 1692 wrote to memory of 5184	1692	Runner_Cor.exe	94
PID 3652 wrote to memory of 1572	3652	Runner_Cor.exe	95
PID 1692 wrote to memory of 4528	1692	Runner_Cor.exe	96
PID 1692 wrote to memory of 4528	1692	Runner_Cor.exe	96
PID 236 wrote to memory of 4140	236	chrome.exe	102
PID 236 wrote to memory of 3060	236	chrome.exe	103
PID 236 wrote to memory of 3548	236	chrome.exe	104
PID 236 wrote to memory of 3548	236	chrome.exe	104
PID 236 wrote to memory of 1872	236	chrome.exe	105
PID 236 wrote to memory of 1872	236	chrome.exe	105
PID 236 wrote to memory of 3492	236	chrome.exe	107
PID 236 wrote to memory of 3492	236	chrome.exe	107
PID 236 wrote to memory of 2964	236	chrome.exe	108
PID 236 wrote to memory of 2964	236	chrome.exe	108
PID 236 wrote to memory of 4224	236	chrome.exe	109
PID 236 wrote to memory of 4224	236	chrome.exe	109
PID 236 wrote to memory of 1736	236	chrome.exe	110
PID 236 wrote to memory of 1736	236	chrome.exe	110
PID 236 wrote to memory of 5904	236	chrome.exe	111
PID 236 wrote to memory of 5904	236	chrome.exe	111
PID 236 wrote to memory of 2756	236	chrome.exe	112
PID 236 wrote to memory of 2756	236	chrome.exe	112
PID 5184 wrote to memory of 236	5184	OrbitR.exe	101
PID 5184 wrote to memory of 236	5184	OrbitR.exe	101
PID 5184 wrote to memory of 236	5184	OrbitR.exe	101
PID 5184 wrote to memory of 236	5184	OrbitR.exe	101
PID 5184 wrote to memory of 236	5184	OrbitR.exe	101
PID 236 wrote to memory of 4912	236	chrome.exe	113
PID 236 wrote to memory of 3748	236	chrome.exe	116
PID 236 wrote to memory of 3748	236	chrome.exe	116
PID 236 wrote to memory of 2512	236	chrome.exe	117
PID 236 wrote to memory of 2512	236	chrome.exe	117
PID 236 wrote to memory of 5832	236	chrome.exe	120
PID 236 wrote to memory of 724	236	chrome.exe	121
PID 236 wrote to memory of 5832	236	chrome.exe	120
PID 236 wrote to memory of 3108	236	chrome.exe	122
PID 236 wrote to memory of 724	236	chrome.exe	121
PID 236 wrote to memory of 3108	236	chrome.exe	122
PID 236 wrote to memory of 2548	236	chrome.exe	124
PID 236 wrote to memory of 2188	236	chrome.exe	123
PID 236 wrote to memory of 2548	236	chrome.exe	124
PID 236 wrote to memory of 2188	236	chrome.exe	123
PID 236 wrote to memory of 3432	236	chrome.exe	125
PID 236 wrote to memory of 3432	236	chrome.exe	125
PID 236 wrote to memory of 5716	236	chrome.exe	126
PID 236 wrote to memory of 5716	236	chrome.exe	126
PID 236 wrote to memory of 1044	236	chrome.exe	127
PID 236 wrote to memory of 1044	236	chrome.exe	127
PID 236 wrote to memory of 5700	236	chrome.exe	128
PID 236 wrote to memory of 5700	236	chrome.exe	128
PID 236 wrote to memory of 2176	236	chrome.exe	129
PID 236 wrote to memory of 2176	236	chrome.exe	129
PID 236 wrote to memory of 5452	236	chrome.exe	130
PID 236 wrote to memory of 5452	236	chrome.exe	130
PID 5184 wrote to memory of 5784	5184	OrbitR.exe	131
PID 5184 wrote to memory of 5784	5184	OrbitR.exe	131
PID 5184 wrote to memory of 5784	5184	OrbitR.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc1ca24e94b383cc9d341e4e3e88bae3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc1ca24e94b383cc9d341e4e3e88bae3_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe
  "C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\ProgramData\NVIservice_iot\Runner_Cor.exe
    C:\ProgramData\NVIservice_iot\Runner_Cor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Users\Admin\AppData\Roaming\NVIservice_iot\YCPNRJNJUIY\Runner_Cor.exe
      C:\Users\Admin\AppData\Roaming\NVIservice_iot\YCPNRJNJUIY\Runner_Cor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Users\Admin\AppData\Local\OrbitR.exe
        
        C:\Users\Admin\AppData\Local\OrbitR.exe
        5⤵
        Loads dropped DLL
        Drops desktop.ini file(s)
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5184
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:5784
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:2984
    - - C:\Users\Admin\AppData\Roaming\defender_kernel\memu.exe
        
        C:\Users\Admin\AppData\Roaming\defender_kernel\memu.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4528
  - - C:\Users\Admin\XRegistry.exe
      C:\Users\Admin\XRegistry.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:2896
  - - C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
      C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:4220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x104,0x13c,0x7ffb519dc728,0x7ffb519dc734,0x7ffb519dc740
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,7340615002471768614,4569897546965343317,524288 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,6659741658343638154,7671982429978480424,524288 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:13
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,978182366832871926,6893299826800711131,262144 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,4795254485292751746,1034276706557945358,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,12692570552839144089,10423412075201043354,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,18338507797940272059,4297585822762623313,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,2798870198807362054,3333597316025364112,524288 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4556,i,409192513798508191,17024757449804170954,524288 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5136,i,1432327693403472968,12436925727332400048,524288 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4984,i,8741905532346946330,2680006977297550769,524288 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5852,i,14256035210085895736,13368336585480974846,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5876,i,15850887221824564512,11013226671849568594,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,11954279568071567392,3553767627258614172,524288 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6188,i,16138045094108755868,3831798849750157794,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5860,i,17577111945552711150,3715908878420528638,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6172,i,9515653734313346335,1331629866108705670,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5124,i,1818541786255386213,1282282452028009945,524288 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5560,i,7812894456710885239,10942066633080057369,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6536,i,2379857765889301895,5630790453289603087,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6040,i,6678647580139155078,2768834987864714493,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,11718407811133671378,3320431924442686351,524288 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6124,i,9659025496252468241,3454134653238565668,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:9
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6120,i,2968607661266084107,6310832753678047516,2097152 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6504,i,9724955771517592182,3438175516897981817,524288 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,8566210946376762964,9705659225048662900,524288 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,2608086555344067444,11087487605753524563,524288 --field-trial-handle=2084,i,7203904218103269096,17445462632491985003,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:3208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65cef63a-7d27-46bb-94f9-64af0f8077b3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\65cef63a-7d27-46bb-94f9-64af0f8077b3.tmp
Size 11KB
SHA256 c6e7d82814eec13c270901359fb17a200230dc95561b4f5e6bbbf1b72475e9ae
MD5 2870633ec3562dbf9ad485aa1a1c4cf2
SHA1 21c1302c52e0ef120a7f1e7d317687d13b8249e0
SHA512 114a984f52183ff317a5cdfa185a75f9ee2a10413d9af067f754fc3d395371a8edf4f3115de3f7a08880d8f2e2e2c4b2f0df2a3be6be1ca10e40b3326c8b124e
SSDEEP 192:gRJxCeAxiv7hAPRp2l98Hsb+WNnrPd7DYkw8aSSLVyIsnAUgR:gRJxTAuAXauwrdAcaTNR
TLSH
T17232A62EB914797B5DCAD21AF9317753E7F5102261D42E84EBFC8A6C14E79CC222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 bcadf5d282d2e01b0b104724e97f85f1fe3ae98ce71e91f491bcfd8673f44035
MD5 c8c7fb0f3c2af0f5aef39a368794253f
SHA1 bd3d2fa3122961bc8bfe043666dbe7aababce9a0
SHA512 d60f90f5c50a0426c5b1f9ff926140b6efd1007d22788e58581090d2a6f6e5523ecc75c845ce7390b55f806709a16e67b2d9213576103bcb7d5e4f394ae9495d
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKN9wcrtumtK2:Majm97KxkXqKf/pUZNCgVLH2HfgslN1i
TLSH
T1A132D827A88D9E7F0FD8D518CC136F8B6CF5429262780D2896FB5D0803A57CE114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ce9414dc425bae139f98d3b114571c27fdb0104075806b585af850263e421f61
MD5 70ca32ce47880752fc111fb0dc445446
SHA1 07e7c9cb62a19ac14c77512f28424428a95eabf7
SHA512 c4ada494fa06cbf9b9a61807cf81f1d9a915d17d18f8b3a71f1f936914c69c461b2393723dc02e7428eb2263c3520bebf32e1fae31ce312f32bc67368e44a4d7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ecbcf76774213ae9c500d8be280ece199a0a29db60323a83271674487be2fc5e
MD5 dbf5a71a3d4e822f79b1ea8fc2c5d672
SHA1 f4957782401cfd28a618b75cb1c6c02601612117
SHA512 b8b15c68a9af97817b44741891eaa15b19480b3e9cb18b25fa5ae9d7c43b255196298cd58500391d7b17b502721cb743485fb5a8eaae361db8edec6b7aee0233
TLSH
T13CA0021041C15965CE154370616546473361989815514353A4D68E858C5B7C0E503610
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 ff2dec84d77eedc48559744c04bf00721d3a730cd6394a57a165263804540738
MD5 93a94a673ae7df173160089de8eb0337
SHA1 dfa4a2cb636f4ce6fa78dc01628b5cefe0548859
SHA512 9f242b28e5aa7b659fcd217cc63cda7db78a92b5de0cdb3f9dc864f9ef3d29baa295658e2ccbdfec73405ea669b882ee1b11b333dfc5976af5a020ea80853aa7
SSDEEP 3072:i6YeyGvxvsuq4u7YCJV5JfEYnMm60tmHP0S6m:i6YeHps/4uhJPiYnMm60tjSz
TLSH
T1C8D312B2CC5EFC171A5BE343215716038D09489144DD1EED9EDA1E36B27FF890762A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 07a900004f7c31aa7172329d4277198b0357cc7758f0a823a3687a007be0e892
MD5 627de117d92d9d002e4cf148d5507b6a
SHA1 2c26c82014db34549d742fbe6a20430c41bed55e
SHA512 53fbfaf6cb3e84f07402da45e89554e828b09c40f26b69577d338dc5fd7571d37f63e88ab2c8032f6df2b6291e76c01d81e5debbb68e9da2404e3acd53f0bf71
SSDEEP 3072:X6YeyGvxvsuq4u7YCJV5JfEYnMm60tmHP0S6m:X6YeHps/4uhJPiYnMm60tjSz
TLSH
T124D312B2CCAEFC171A5BE343215716038D09489154DD1EED9EDA1E36B27FF890762A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f5a89d318a652bf6931ca6cab11c056ef184fef065689277cd5bb126ef5d95e3
MD5 e541df8be34597e86c27b58ba39f3125
SHA1 1ad4d8cf77e0539cb62976446422ebf07b9cddef
SHA512 f523a119773dae860209894bdc1d748989f6854a8aa2d740f6bef7a6a50e961eaaa129a0cc706b48a32eee82ac2360fc1581f2704d1d506150cdcc20e0c902ee
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5mHD0B6eGyvkonDob1v4a:MC0HJm5FHuPgXDUDk4W8nDobZ
TLSH
T139A12AF1A4A948B759B7D345F8832A83DEA4A22769A1EF80D9DD1E0C01F71D81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 5a1b410a062d4bc44e3bd60d899d6d0fd80c800ce4bb495a9465cceae77c6c95
MD5 cc0341914ae30ae3d53a3ef4fa0b119a
SHA1 1ea0982adf77183038dd1d1deb93ff84aab5d6f5
SHA512 658656ef1e27c96302f0c7b90294216188d89514f82b61a380d0c8efd9787ee8c7ebd36cfd06d092efc25e837746d570367d6556195af74d3374686fd0e78538
SSDEEP 3072:26YeyGvxvsuq4u7YCJV5JfEYnMm60tmHP0S6m:26YeHps/4uhJPiYnMm60tjSz
TLSH
T1A4D312B2CC6EFC171A5BE383215716038D09489144DD1EED9EDA1E36B27FF890762A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OrbitR.exe

Path C:\Users\Admin\AppData\Local\OrbitR.exe
Size 1.1MB
SHA256 d7e56ec27a3f8ab8c6b81cb146ac41c1e14ef8317dc8680610a9cc906e49d7b2
MD5 6bc2b98cad631e321727a8a0e049498a
SHA1 9758e82fe36d55df726d4afa0e55989ec2a515d0
SHA512 e3bbf585d3d4b26439b9a4572d3f17d1ff756800b3376f64b208d8dfb7b994866197767bfa1587e31a78a4ed8339849e8e62eea492eef439d85212913fe4301c
SSDEEP 12288:UcP8/ti/Kc9L6/Wm/GMKBJK68xHyeQUur/RYiG7jP1Vt9NOSblN+R/2krPjqn6FF:U48F0vL6umGLHgd9EwNIO8+6FSkqq3
TLSH
T133358D607B49D63AEA920173CA7DAB5F211DF5620B2915C3F2CC0AAC5D706D36E3A707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5C0C79C.tmp

Path C:\Users\Admin\AppData\Local\Temp\5C0C79C.tmp
Size 15.6MB
SHA256 f21069976bf3788a3f74887467428bcf73df7123178cd22111ed7b7dc52edc4d
MD5 a5913ea05c1db6925dcf6ab4fd0e5915
SHA1 9cda746aa31ad030bf137459b051641bad70bec0
SHA512 7f0e5c68486d66d8c3b50a984710528f66d0237ac6cb4bab16ad85169e94521df35ae899c07cde6822aee18245411a69826c739c67f13f68b01a9662dbc3f745
SSDEEP 393216:8uRFgt5fiO413+hgEOMtGaD8WFGQVzunC+V1fWAfx:8EFgt5ishgEhtGU4wzKC+V1Fx
TLSH
T15FF633B6988FD6E93F56B0F1AC86C034DD48BCD572B8F214BAC0E452DC0583E9697D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5C0C79C.tmp

Path C:\Users\Admin\AppData\Local\Temp\5C0C79C.tmp
Size 15.6MB
SHA256 3f201a143dbe79290731ae6abbfd28cc5d310cf2101ea2f386ea665d8b161a11
MD5 02ca1e7ba584fff45c6943913e290c07
SHA1 9e641784a4c929fb28bdbeac9f07d18fd7307652
SHA512 9a407a2c8afbd6fc4e74819e21a8270da4a0f0f0d778e40c4191dad22edfeb014c8a26e9ce8132ca75ca14ef71f49934bbdcb40436d4ec7747b129ca445c66e6
SSDEEP 393216:+u1Fgt5fiO413+hgEOMtGaD8WFGQVzunC+V1fWAfx:+QFgt5ishgEhtGU4wzKC+V1Fx
TLSH
T1BEF633B6988FD6E93F56B0F1AC86C034DD48BCD572B8F214BAC0E452DC0583E9697D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B491A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\B491A7.tmp
Size 5.4MB
SHA256 5dc378d0d4432c5f719800e7f57faece912bc27483a7481d8cb3d605a15cc31a
MD5 ae780136fcd0ebb81f1aeb12dbed8c68
SHA1 f9203b56e4269257017448f7de55fa7d96732c00
SHA512 ef28246c33b982870c7b4fc4bb731693ddbcfee8fd29af3556c3bf393946b255edc6a0ae82c942e1b5bdee668fd64da01e9dc67be3fb0fd98bb5a8c78a0b062e
SSDEEP 98304:EP8ubIg/+tRFVMkN7RiVpi19E7g/U5RkrJppA7GAUboWv22S6h1Apn8/VgopRJmJ:EUux/6MkvG62g/dJpGioW86hin8/VgQO
TLSH
T13A463349F7D4826A7723DCC32E6FCB24B179CA93989D40DE05829583E65EB0F2D0BD94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B491A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\B491A7.tmp
Size 5.4MB
SHA256 9e3ef8c35cded55baf49b1314831679e0b85fc699287624e794408abc2ee1ec5
MD5 2b0ba5115f62e66d7fa6f9029a7ba544
SHA1 8ca6edacbc2ea16378fa479d4b1a80946f1bfdf9
SHA512 0d3c215bd81acb9717f5f2b16c74e2f9876fe39b1cfb918b349218e0aa870c5f38671a7b3b6cae45a25453038cf450897831b68542655122da2b2877f113c909
SSDEEP 98304:Nk8ubIe/+tRFVMkN7RiVpi19E7g/U5RkrJppA7GAUboWv22S6h1Apn8/VgopRJmJ:NBu//6MkvG62g/dJpGioW86hin8/VgQO
TLSH
T105463349F7D4826A7723DCC32E6FCB24B179CA93989D40DE05829583E65EB0F2D0BD94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BE6812.tmp

Path C:\Users\Admin\AppData\Local\Temp\BE6812.tmp
Size 40B
SHA256 db8396c64c01fc742f765ab7c74ce07364fa07c4ed99d3642b79e978905e9b87
MD5 fa9aa66965b6183eebd9a71c2681dbd5
SHA1 26783651916f0a6da3601d6cbfad95c5d96a2e17
SHA512 2ffc557feb6aafb947e6d2ae44d5e744ed54e003c902799b35b7d1ebad21cd5eaf6c77785df43915ce7626cbe6481202d0c7f0cff076268171355b89d1948f12
MD5 SHA1 SHA512

Submit Download

DebuggerProxy.dll

Path C:\Users\Admin\AppData\Local\Temp\DebuggerProxy.dll
Size 358KB
SHA256 2760521e67d374303447a6d75bf6da7aad6fd0057aed526b163d241ea98acd17
MD5 b2b975f47e8fa68bf5cf4b452b78fcd8
SHA1 3125be67c772dcad88a076f0f0196bd8d440e379
SHA512 f0b64e78c05e4fbbd1ec7fc28c011c531766d28a4a3f469ba51f92600b3db29284a922efeaaad265126cb4c8e41ef43132bee66f337361f80965f50677a0b949
SSDEEP 3072:RyGPDDc3I6S8YtqKOZBeHAUWbvm8/1wRPF2qGatRToxr1M2tbWRLRXMj+VqKzzIO:XcBCmcHbKqGOWr1M2KMjy
TLSH
T1DD74E853F7648438C5AE64369466E334A3682E18B3D076DB9A807794B8B3581EF33FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EC42629.tmp

Path C:\Users\Admin\AppData\Local\Temp\EC42629.tmp
Size 40B
SHA256 fc4e59f363497c434cc486e25172bffcecf2721ada5218859b8cc7ea5577b171
MD5 45ae407ad9d05f64ed52307907dd9425
SHA1 8c617e1e13c01f5a09161ba3b4fad3a8368ad2ed
SHA512 053c039ba498e6464353ce7a34b5362de69149374f620697aae4507b2704b7814ac4d9e72ef2524c8a384c9dd18f94938beb9fbe122c1d441cd8b06d155b91cf
MD5 SHA1 SHA512

Submit Download

Runner_Cor.exe

Path C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe
Size 6.0MB
SHA256 e4547515dfa570f2f3450fd83249db59896b0a7896110f2c8897fb3fc9eb9e6e
MD5 d76c8443fc58215fbee97905c056e421
SHA1 8900008928d313cfb472c0a9abb104be3e0db4d8
SHA512 7d04c2b0dc13a22bf1fa6a329842e7ce2afc41c1ff37540d93600d8540f3fb2bf83558b8945da4f8e67c779c31b4d5e80f38c488079fa6d9d7e580ad617cbd0b
SSDEEP 98304:ERAVV/Zj6Uui3jg/MxS/2dStFQ4ldOAQ5i7JSToVE/5l7LBi:GAxj6Uuas/Mxw2gtFQ4ld1rpkz8
TLSH
T117569E21B910C171E6D10132EABD6BBB546C96311B2C10DBE3E45A3AAD705D36F32F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dDkm68C.7z

Path C:\Users\Admin\AppData\Local\Temp\dDkm68C.7z
Size 16KB
SHA256 995e58f9296af8ff29dee781b5460af641a093d17e286e0d06fde23622104643
MD5 c9afcc80af1f168fe48450422ab4d44b
SHA1 a3aeb8ec72f15dbc0ed7daa34a62e8585ee0eead
SHA512 92d26b18aedd2037598dd1062b8c0739bebe4c1280b40f9e6a24874310a480a2f4bdcdc37489cbdf2bd12ec8d8709fc07aa5612482f8fbf6e6e0e0218bfa9ee8
SSDEEP 192:4Yn6oSbm7YnGmjnAboU7DCCoiyYOtTUnWrs1J0MPN3tAluIbBY7hAFY2IscuV7Hj:3egYGmUkUrqPSJ0AAusiWW2LVJ7/qxHq
TLSH
T13B72D115A535319CD2FEBE480DF1F61F83E332105EA0A2EE172295E6C61B2A6733D56C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filter_spec.meta

Path C:\Users\Admin\AppData\Local\Temp\filter_spec.meta
Size 26KB
SHA256 54cdf3af232a79976749a7f945b07d45b69bbc69f5efa3c9f30b9ac1149df8fd
MD5 19bd0258d73e7f1795208ee9e1af564a
SHA1 65e8914e54e3cce98b39c84aea29292b1a463fd3
SHA512 dd9674c02ddea8e921869a800c131da6bbcbeb620330d0a99fd1e5ea1d7ead283caea3d7f107403f3d4bebf771e2763ad03b9fe3cb47100a0319db1c58ff0410
SSDEEP 768:n7AD7GCjxI6lOOWhEHagrvVtfNG/ZW+13Og3dR:n8bjxInhE6gQZWy3OqdR
TLSH
T149C29E7E865F8F94A14F983DEC24E0D3C254F1B93D0E256261DA08ABB816DEDC124CA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mss32.dll

Path C:\Users\Admin\AppData\Local\Temp\mss32.dll
Size 345KB
SHA256 bddb62373f616bf8edd6cfe580d80b2fd0325069f59fbc2b70b2cb0458241926
MD5 ef698a81b3db0654e4ee65a8deaa8a59
SHA1 764826c1b2612ce1ea0b904af63cd1faeb41c87b
SHA512 a96e683d3d3c50dad4d7706a7a7b8a05a6a7ed304971a2cada137a573464396d04675733692aa1d4594cd7ca25e78eaf1e9d26f75c24f4e55053b49c9fdd2695
SSDEEP 6144:spcTapyHuUcl0PUpFawtMR6gP4aHrmtcER3uAy:EIaQ+l0PoVtW6aHrmtcERty
TLSH
T13B745C20764002B6C4E1387BE83E3B39A4BD9F696686116B3545CCAD1E73DE0B74F61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 485KB
SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
TLSH
T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandbox16.json

Path C:\Users\Admin\AppData\Local\Temp\sandbox16.json
Size 11.7MB
SHA256 61fbc14519c0ada8aeb81b92bb2573ac57dfdd956f88dc4d1fb486a025786980
MD5 bd65369fafb0b4df465e6becffe8d915
SHA1 cc93f4e8c4e7a0a2bd4477ff9cf119f599779105
SHA512 77646380accda7299a20d9db5d4b5350429baeb64c1b74b8c71b6493b7c76ca909b4258c7026bc9f4e7e33eb88a4c2923c6d506cc77533ffb4a3f7bb2e6454aa
SSDEEP 196608:nHGSv6Xpc6NAgLVzCTx6EMomaaYJaZhLCIKt/LcTrLclAWQEV2jiEmDsqxxdGHPp:mSv6Xq6EMlaqrQL+ElAWQSIYIq/dqB
TLSH
T14EC6331D8ACA5766D4B87CB5E24D0B929CEDF4C2CEB05B31AE68C1D520AF04F25493BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir236_1212732980\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandbox16.json

Path C:\Users\Admin\AppData\Roaming\NVIservice_iot\YCPNRJNJUIY\sandbox16.json
Size 4.7MB
SHA256 431bf199d1b71077278581a453819af78c441c20420fd33ea6e6386bf66c9f60
MD5 b6f2583dfa06c02e3eaa1ad1e1a508d8
SHA1 328d3a644b8793ddc267ee4a12137a534ead3b5f
SHA512 371b770f6019bdd8243dfd2bdcc23c718b0308713b7342cd47eb91ad3a303b7ef3be16a298387569d4097f0086c4f21cc89cd3eb6914b9b98e4edb28bf1a48e5
SSDEEP 98304:hxNYS5a9KuB1zNX/10REQq1F8c+y/qLLgaHY2l9btQR:qGa9KkDX/1lz1iBYUS
TLSH
T12C3623FF9BDA8272E62F07715FC361B7C64EA074C7131781CD05F1836A2BB61A25162A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XRegistry.exe

Path C:\Users\Admin\XRegistry.exe
Size 636KB
SHA256 7783faf41c933a01379be18ac070431c244a95a3bf361897ce471eb4040f63e6
MD5 331bc2bf689bedc4496b06b5d7d47bfa
SHA1 c51dd717b5330b8cd5ea6cc0da8aca60ce985bb9
SHA512 ecb21af850002e17393e9a0b46ac5eeb6e2d4403de406bb9fa243b6375f37a075ff47395211335ec1576ccaf41953972afdabf2803d3d4bca57b86c276a69bb0
SSDEEP 12288:WwvXiMGkWpV1j9hcYtHDlUJNlz9PFu9oT/+2I:WwvizD1fcaDqJP9k9j2I
TLSH
T103D47D0BA3A441F9D0BBE178D9075956F7B6B85603B09B9F23E042672F572A09F7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1572-105-0x00007FFB77B60000-0x00007FFB77DC3000-memory.dmp

Download

memory/1692-91-0x00000000749B0000-0x0000000074A02000-memory.dmp

Download

memory/1692-112-0x00000000008E0000-0x0000000000F48000-memory.dmp

Download

memory/1692-71-0x00000000749B0000-0x0000000074A02000-memory.dmp

Download

memory/1692-72-0x00007FFB77B60000-0x00007FFB77DC3000-memory.dmp

Download

memory/1692-74-0x00000000749B0000-0x0000000074A02000-memory.dmp

Download

memory/2896-111-0x00007FF727D40000-0x00007FF727FA9000-memory.dmp

Download

memory/2896-110-0x00007FF727D40000-0x00007FF727FA9000-memory.dmp

Download

memory/2896-90-0x00007FF727D40000-0x00007FF727FA9000-memory.dmp

Download

memory/3264-28-0x00000000732E0000-0x0000000073332000-memory.dmp

Download

memory/3264-29-0x00007FFB77B60000-0x00007FFB77DC3000-memory.dmp

Download

memory/3652-40-0x00000000749B0000-0x0000000074A02000-memory.dmp

Download

memory/3652-47-0x00000000749B0000-0x0000000074A02000-memory.dmp

Download

memory/3652-35-0x00000000749B0000-0x0000000074A02000-memory.dmp

Download

memory/3652-36-0x00007FFB77B60000-0x00007FFB77DC3000-memory.dmp

Download

memory/3652-37-0x00000000749D0000-0x00000000749D1000-memory.dmp

Download

memory/3652-38-0x00000000749B0000-0x0000000074A02000-memory.dmp

Download

memory/3652-65-0x00000000749B0000-0x0000000074A02000-memory.dmp

Download

memory/3652-48-0x00000000749B0000-0x0000000074A02000-memory.dmp

Download

memory/3652-57-0x00000000749B0000-0x0000000074A02000-memory.dmp

Download

memory/3652-64-0x00000000749D0000-0x00000000749D1000-memory.dmp

Download

memory/4528-122-0x00000000749B0000-0x0000000074A02000-memory.dmp

Download

memory/4528-118-0x00007FFB77B60000-0x00007FFB77DC3000-memory.dmp

Download

memory/5184-628-0x0000000000F30000-0x00000000012B9000-memory.dmp

Download

memory/5184-93-0x0000000000F30000-0x00000000012B9000-memory.dmp

Download

memory/5184-590-0x0000000000F30000-0x00000000012B9000-memory.dmp

Download

memory/5184-107-0x0000000000F30000-0x00000000012B9000-memory.dmp

Download

memory/5184-125-0x0000000000F30000-0x00000000012B9000-memory.dmp

Download

memory/5184-162-0x0000000000F30000-0x00000000012B9000-memory.dmp

Download

memory/5184-104-0x00007FFB77B60000-0x00007FFB77DC3000-memory.dmp

Download

memory/5184-95-0x0000000000F30000-0x00000000012B9000-memory.dmp

Download

memory/5184-685-0x0000000000F30000-0x00000000012B9000-memory.dmp

Download

memory/5184-718-0x0000000000F30000-0x00000000012B9000-memory.dmp

Download