hijackloader | 74a1e4dead91d597b2474e157272794d0c43c877d79565b3ce306331f0bfe8b0

Analysis

max time kernel
299s
max time network
301s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 12.7MB
Sample260820-wpygbasgnd
SHA256 74a1e4dead91d597b2474e157272794d0c43c877d79565b3ce306331f0bfe8b0
MD5 bc1ca24e94b383cc9d341e4e3e88bae3
SHA1 3af49cdb64729c8be2d1ac10aa7106f0492e20d6
SHA512 48f6bb762da740621381b261b6741856b8ad39058b65f0b902b8bb2abff769c0310c12e02674dcfc747751a80364964fa0dd6a7062896dc702dc3e93594dbc16
SSDEEP 393216:+pwU9vgFyZtgHKGy96ys1Jf/3HviCHDn1ASXMyq/s:ewuIgwq4J3/iCHRAgtq/s
TLSH
T1A5D63360739578F8C322903AEF0DE35966F6E3A02B014E9A3BCF1D265E571B1494F4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

e4d12643d44b0f664cb095b3db1c2aa6 credential_access discovery hijackloader vidar loader persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\NVIservice_iot
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

vidar

Version

Botnet

e4d12643d44b0f664cb095b3db1c2aa6

https://62.238.46.160
https://telegram.me/m1duus
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=YmbK
https://steamcommunity.com/profiles/76561198657426610

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x001b0000000283b7-32.dat	family_hijackloader
behavioral2/files/0x00070000000284b6-73.dat	family_hijackloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	Setup.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmanager_core.lnk	OrbitR.exe

Executes dropped EXE 3 IoCs

pid	Process
5100	Runner_Cor.exe
2056	Runner_Cor.exe
4316	Runner_Cor.exe

Loads dropped DLL 10 IoCs

pid	Process
5100	Runner_Cor.exe
5100	Runner_Cor.exe
2056	Runner_Cor.exe
2056	Runner_Cor.exe
4316	Runner_Cor.exe
4316	Runner_Cor.exe
3004	XRegistry.exe
3208	OrbitR.exe
4856	memu.exe
1072	memu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	OrbitR.exe
File opened for modification	C:\Program Files\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2058276091-3280583803-376660292-1000\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	OrbitR.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3004	XRegistry.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2056 set thread context of 3004	2056	Runner_Cor.exe	95
PID 4316 set thread context of 3208	4316	Runner_Cor.exe	96
PID 2056 set thread context of 4856	2056	Runner_Cor.exe	97
PID 4316 set thread context of 1072	4316	Runner_Cor.exe	98
PID 3208 set thread context of 1848	3208	OrbitR.exe	104
PID 3208 set thread context of 4632	3208	OrbitR.exe	119
PID 3208 set thread context of 1848	3208	OrbitR.exe	104
PID 3208 set thread context of 2896	3208	OrbitR.exe	125

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\Microsoft.PowerShell.PackageManagement.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.MsuProvider.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.boot.tree.dat	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png	OrbitR.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Input.Manipulations.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\uk_MASCULINE.pak	OrbitR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\initial_preferences	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tools.dll	OrbitR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ko_MASCULINE.pak	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\orb.idl	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\EmptyReport.rdlc	OrbitR.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeGreaterThan.Tests.ps1	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XDocument.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Forms.Primitives.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\INFOMAIL.CFG	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.Serialization.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\OOFTMPL.CFG	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\POSTL.ICO	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCDRESTS.ICO	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\JOURNAL.INF	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-process-l1-1-0.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\UIAutomationProvider.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\NOTE.CFG	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\THMBNAIL.PNG	OrbitR.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac	OrbitR.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.GZip.dll	OrbitR.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeNullOrEmpty.ps1	OrbitR.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Context.ps1	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml	OrbitR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ja_FEMININE.pak	OrbitR.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\corerunner.job	memu.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrbitR.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1376	chrome.exe
3284	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317230365365733"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3208	OrbitR.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5100	Runner_Cor.exe
2056	Runner_Cor.exe
2056	Runner_Cor.exe
2056	Runner_Cor.exe
2056	Runner_Cor.exe
4316	Runner_Cor.exe
4316	Runner_Cor.exe
4316	Runner_Cor.exe
4316	Runner_Cor.exe
3004	XRegistry.exe
3004	XRegistry.exe
3004	XRegistry.exe
3004	XRegistry.exe
3004	XRegistry.exe
3004	XRegistry.exe
4856	memu.exe
4856	memu.exe
4856	memu.exe
4856	memu.exe
4856	memu.exe
4856	memu.exe
4856	memu.exe
4856	memu.exe
1072	memu.exe
1072	memu.exe
1072	memu.exe
1072	memu.exe
1072	memu.exe
1072	memu.exe
1072	memu.exe
1072	memu.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
1848	chrome.exe
1848	chrome.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe
3208	OrbitR.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3208	OrbitR.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2056	Runner_Cor.exe
4316	Runner_Cor.exe
2056	Runner_Cor.exe
4316	Runner_Cor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeDebugPrivilege	3208	OrbitR.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe
Token: SeCreatePagefilePrivilege	1848	chrome.exe
Token: SeShutdownPrivilege	1848	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 5100	4896	Setup.exe	84
PID 5100 wrote to memory of 2056	5100	Runner_Cor.exe	85
PID 2056 wrote to memory of 4316	2056	Runner_Cor.exe	91
PID 2056 wrote to memory of 3004	2056	Runner_Cor.exe	95
PID 2056 wrote to memory of 3004	2056	Runner_Cor.exe	95
PID 4316 wrote to memory of 3208	4316	Runner_Cor.exe	96
PID 4316 wrote to memory of 3208	4316	Runner_Cor.exe	96
PID 2056 wrote to memory of 4856	2056	Runner_Cor.exe	97
PID 2056 wrote to memory of 4856	2056	Runner_Cor.exe	97
PID 4316 wrote to memory of 1072	4316	Runner_Cor.exe	98
PID 4316 wrote to memory of 1072	4316	Runner_Cor.exe	98
PID 1848 wrote to memory of 332	1848	chrome.exe	106
PID 1848 wrote to memory of 3284	1848	chrome.exe	107
PID 1848 wrote to memory of 3832	1848	chrome.exe	108
PID 1848 wrote to memory of 3832	1848	chrome.exe	108
PID 1848 wrote to memory of 4952	1848	chrome.exe	109
PID 1848 wrote to memory of 4952	1848	chrome.exe	109
PID 1848 wrote to memory of 3004	1848	chrome.exe	110
PID 1848 wrote to memory of 1420	1848	chrome.exe	111
PID 1848 wrote to memory of 3004	1848	chrome.exe	110
PID 1848 wrote to memory of 1420	1848	chrome.exe	111
PID 1848 wrote to memory of 3840	1848	chrome.exe	112
PID 1848 wrote to memory of 3840	1848	chrome.exe	112
PID 1848 wrote to memory of 3568	1848	chrome.exe	114
PID 1848 wrote to memory of 3568	1848	chrome.exe	114
PID 1848 wrote to memory of 1728	1848	chrome.exe	115
PID 3208 wrote to memory of 1848	3208	OrbitR.exe	104
PID 3208 wrote to memory of 1848	3208	OrbitR.exe	104
PID 3208 wrote to memory of 1848	3208	OrbitR.exe	104
PID 3208 wrote to memory of 1848	3208	OrbitR.exe	104
PID 3208 wrote to memory of 1848	3208	OrbitR.exe	104
PID 3208 wrote to memory of 4632	3208	OrbitR.exe	119
PID 3208 wrote to memory of 4632	3208	OrbitR.exe	119
PID 3208 wrote to memory of 4632	3208	OrbitR.exe	119
PID 3208 wrote to memory of 4632	3208	OrbitR.exe	119
PID 3208 wrote to memory of 4632	3208	OrbitR.exe	119
PID 3208 wrote to memory of 4632	3208	OrbitR.exe	119
PID 3208 wrote to memory of 1848	3208	OrbitR.exe	104
PID 3208 wrote to memory of 1848	3208	OrbitR.exe	104
PID 3208 wrote to memory of 1848	3208	OrbitR.exe	104
PID 3208 wrote to memory of 1848	3208	OrbitR.exe	104
PID 3208 wrote to memory of 1848	3208	OrbitR.exe	104
PID 1848 wrote to memory of 1756	1848	chrome.exe	122
PID 1848 wrote to memory of 5072	1848	chrome.exe	123
PID 1848 wrote to memory of 4208	1848	chrome.exe	124
PID 3208 wrote to memory of 2896	3208	OrbitR.exe	125
PID 3208 wrote to memory of 2896	3208	OrbitR.exe	125
PID 3208 wrote to memory of 2896	3208	OrbitR.exe	125
PID 3208 wrote to memory of 2896	3208	OrbitR.exe	125
PID 3208 wrote to memory of 2896	3208	OrbitR.exe	125
PID 3208 wrote to memory of 2896	3208	OrbitR.exe	125
PID 1848 wrote to memory of 1376	1848	chrome.exe	127
PID 1848 wrote to memory of 2936	1848	chrome.exe	128
PID 1848 wrote to memory of 1416	1848	chrome.exe	129
PID 1848 wrote to memory of 1416	1848	chrome.exe	129

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe
  "C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\ProgramData\NVIservice_iot\Runner_Cor.exe
    C:\ProgramData\NVIservice_iot\Runner_Cor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Users\Admin\AppData\Roaming\NVIservice_iot\DCNFHTFHQFYN\Runner_Cor.exe
      C:\Users\Admin\AppData\Roaming\NVIservice_iot\DCNFHTFHQFYN\Runner_Cor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\Users\Admin\AppData\Local\OrbitR.exe
        
        C:\Users\Admin\AppData\Local\OrbitR.exe
        5⤵
        Creates a file in the Startup directory
        Loads dropped DLL
        Drops desktop.ini file(s)
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3208
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4632
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Roaming\defender_kernel\memu.exe
        
        C:\Users\Admin\AppData\Roaming\defender_kernel\memu.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1072
  - - C:\Users\Admin\XRegistry.exe
      C:\Users\Admin\XRegistry.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:3004
  - - C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
      C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:2080

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff90e33c728,0x7ff90e33c734,0x7ff90e33c740
  2⤵
  PID:332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,8913185191674456191,2216145996169978383,524288 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,10543406164428716051,1255000128648601756,262144 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,3977214910975620792,7825606268450832359,524288 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,15659586614000939559,13775662942467191799,2097152 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,14564959797853126752,16805954258021710481,2097152 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,2150045402699713455,17867765956573532713,2097152 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4632,i,2567328728965877113,15957198339640457428,2097152 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,13003766296790197032,4235236417543574857,524288 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,6593815769980903864,18162470311451875112,524288 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,6090371853214519148,11058685160197306095,524288 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,15353662725599677191,15251410230499378540,524288 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,13813853046961577531,4270497905751641048,524288 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5424,i,14752194555398990162,11160054288132265680,262144 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3116,i,4966000147712215476,6689106170658101567,524288 --field-trial-handle=2092,i,10140836236230680209,4498921586738152993,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  PID:1416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8051c7ec92e7ba191a2f4fba2faa2d1048429bd3

Path C:\ProgramData\Jovise\Cusak\8051c7ec92e7ba191a2f4fba2faa2d1048429bd3
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

Defuto

Path C:\ProgramData\Jovise\Defuto
Size 6KB
SHA256 eb783c2ab3d25961fa94b676458a6f9959eb1ef065a2f517fe14d26c170a4f0a
MD5 e72261ea352ace97e1dbc745ff53172a
SHA1 fff448a640b4f3cde61474fb2da3385853b14311
SHA512 a46f7bfded4c3c6e4bdad9e6b88350ab2f630e5883b5b6aede8bf3052acf9dca4e27a9d66bc88ecaef7be8436dfe24807f9070020d0628812bf02b7145a14cf4
SSDEEP 192:jPDHYWJRQysrVe4QLG0bqtyUtFNyzIVTjwdOAwNOJ9:jkWJRQysR/EUy2FiA3wdjwNK
TLSH
T16DD19F0833145266DC3D6BD86F806EF3A405B693B50489E2837FB742A95940BB73CB57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fivutake

Path C:\ProgramData\Jovise\Fivutake
Size 3KB
SHA256 6954903a1ffc94a6989ab89fb0dd933b69380e2a082203b87eb632a94b7f957a
MD5 bb23f045060de0630e61a4c7d30c0937
SHA1 fa584564a42fa0f56e48591533aec33da2fe5c08
SHA512 9ac5c67c7ccc85fc30ea5124149255164f7898dcd5a0e3c7fecb835aae2cf086e788df27b8c76d429a8ef9b28cb6feee510d58002995e75431299df598c98c9c
TLSH
T19B515A6A0EBE65B955105BC4D136F6B49F32E72893FD9AEF00B223D04BF83522548083
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8120cad13255b238e7b94523bec06db5a0161b9fdb152403a0e2d63cb78df63c
MD5 c1b9619b083747918814f2128eea7653
SHA1 bc09f3ed66641ac53464b5f6237b0268f3a4f40c
SHA512 d4523c1629555ae3b900eee9e9c09d40ddc04daad032038abc2b9bcace71cae5b19dca15c32f8c0b59e5bd7547e91f710eb439a76f4b076facd5d3713cf0b59a
TLSH
T19FE02B65C821EC3708FD1B1C90648A86EB4123671A40895F3B3CD10C8FB57764AA685C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 16KB
SHA256 f17eda522274022c92f908a8b3662b3fff58dddeee793dd8458fad15bdd936e6
MD5 3151be3888950cc6ffe7fb11fed2f31b
SHA1 93c9f24392c7045042ed347b04a334533f81f4fd
SHA512 17f4fb334ac0df908b42790d39f257da07f490237ac087318cb0bfeca27ad84372126b048b3f36af62f9af036ad8902e6780b9b2df7e6fabce86f98c2e823ab6
SSDEEP 3:OlH/lCup5shXCTipOjnkqy1XakWllUlh1vqK1caaulxCTip7nOlwXaFO+UlGWi9p:KQu4ETiSnjcu/UxrETi1OwsO+UDkl/
TLSH
T173725EEB936D251AC8D2F27EDB8683D2A3035F2443AC9E88D25B997050207107AFA5C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 547ed9c59412c8e9a534eda31a3963a2ff296d918acb7962c3fc5ae3165587f3
MD5 134a0e6fc117e6a4451d50e985e954c6
SHA1 736b3f7119913dfa05c18f84d24b63f649a82807
SHA512 cd77499468f467735d73956565990be170e45ef9b53588790bd4db323566f0f9991651541c32300fa927dffb6ffe7f20c808ce21566233c42850f5dfd727db91
TLSH
T129E026963ACCC26DE8A4C423867CB34C8ED13445A2DDBD032745888431A6604E2A0340
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 1KB
SHA256 617b5bc7c722e91193fdc405b40242690f1d37257fb23522c92c3e66e1d7de1c
MD5 407ed93fa0eb879f0c588b6eee453418
SHA1 a1f9c12d6fb9101793da2bdc3e617246d467f80a
SHA512 ef35a25285b034aa4f1ff9058edbfc3442c0cead1964c7fdc291d48675ba6e8c5fbe581355c987e6da83692693cf46784a11e0240fa1b9c31fc9420577692cbe
TLSH
T10731F74D3F40721BFF2A5EB62D6253277D7096A906C49CC383F55D5A1C87B901612049
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 305B
SHA256 f880d5cc44c63a8204b9e4f549da5c2d157902e2fe7abf25b7556045471808c1
MD5 9653c146b6a5fbf5b7f73c56cbea2078
SHA1 443a7f95c403de021020ce81a05c9e38c419881c
SHA512 8ef9c7943ad518e01253c304560cac0e27f3094396defe89e972194230998feb9ff9f62d930e0c23914a7289e3fc43332ab08ae29b5c32e1b63b91a2eefe9ff5
TLSH
T1EEE08C4676ADC36EE58490135A78B34DCBE438859ADEAE435B00A4886186808B29179B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2482d674fdddb771a9074708c2a567368707d9629953e267997d654bf865395d
MD5 08fb7e1551808c4221114c34e380067a
SHA1 274c233918f795f7dce3959fcf7c0336454dbc25
SHA512 ac4eb6452c1658cb43d3fc1b7a5f8d647a62d3dd59021bb8b330a45f1d0e1f2d875dbd53c44dd38e943fe64c42d296f38a71bf16486b875c722b590a3a8d8bf0
TLSH
T17F51BDF7D3E4967D855166F4DA256E1FDE2E0A24121C3C62C8D4AF5B53E2872D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c89aec372aaab700461c6629bdde74c177a283dc4d274c4eb49a71912ec7fd47
MD5 ed9b52dbd5805040858f66a21ddc9396
SHA1 78df3304ab171f934f67a6a2771db57f64f98f3b
SHA512 a53a5de9eca5fd9d03384e5d7839518ed916d793bfa2b0d84b6e5d24b84272ded334b1843962d07cc725a2b54a21ff0f720837c2fba2538ed2f27ce5ddcd8b5f
SSDEEP 192:3ROQ9eSTQv7bpAPRp259/Hsb+WNnYH0iA24nssAHaIuVyIsnAUgtaJ:3ROQnMPUXe1ww0H24nnyal8
TLSH
T1AE42EC2EBA10B43B6CD6D21AF9127763D7F5107121942E84EBFC862C15EB6CD222711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4a8de811b93ad52e9d4022e9fa8a9091cc20b5ffab88a1e0f530f17ec1f4af83
MD5 469645fc081cfe6eb6c54d3ab7d6055c
SHA1 a833172ee1a4cfdf987c031a33c493f52999a2a9
SHA512 e6874d4c0de8dab37c06cfe06c0e7f6a0485f59eca431899ec8c9501c7f2f35d5061c79cd8a90a2176dfdb88432ceb4ee67ce09a6e5a875caf924a573ae28e55
SSDEEP 384:RrjNI7KxkXqKf/pUZNCgVLH2Hfgsl4Tv7pLuLcSj/6XODNI+ErU3BtvHG+lGGEVP:RHNI7KxkXqKf/pUZNCgVLH2HfgsmT7pL
TLSH
T13D7209677C4C9A3B0F94C6CCE8177B4FADB5025B26E9886543FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ee72ed19f958330d6288d92b3d0033fad41cb6438e23c8b82ae0ccb01f5700a8
MD5 d839a5ddd3419c534f2257f155fa9171
SHA1 15df1295245fa81dd461360d04659343e6b762e6
SHA512 128ba03fff8b7dff35ba1f83f854bd4853647572ccf982e593905928dafd761e845253f02bc099b0cf2e0e23fa26c09abbbeeb7e45f1dc0f341e4bc1874898f7
TLSH
T120B01240C0026502C04302B0224618C87124AF51AA8F170543E06973CC2516186280A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1771.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a1771.TMP
Size 96B
SHA256 ebc4fd67b3f516eacbb6ec43f94561491228fb82e852b0e0ea4e08ff9c093bb0
MD5 7ba337e084c222d909b2ea692752e463
SHA1 f546e8e0657943d7e90d63d43adc980a4b599022
SHA512 e270166b47f714d2685479bf7f7ad76ae86891265cd5243445ba4f03779afdad19da2a80b6947b798cd0db38998513c2e21fa4b0f160e58a65bad6996dbd9ea5
TLSH
T13EB00255C5026722D0430BB0359695DC71A0EF35C6531A12E2F41EB6EC3AAB15529560
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 270B
SHA256 3530055a62ddc24a89dd97751ac9db187d009eb8193a29a3636cae2567d4a4cd
MD5 70ef71dd0fed6c14b2b6e149267a2c2a
SHA1 b8829ea9631cd5e0aba87d81e71047ef5fa92f24
SHA512 2ed43127bcd5443c4cd04a01f70de06c50fcef1f284ee4dfec07e605133aa5cd6a1e197dbc0c6e73679af491b976a7304e8d38d58c948cb55471399978470241
TLSH
T1F3D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 320B
SHA256 492960969b1181b7a415689eef9fd2fa5aaacdafa31e7c054a16c75e7a862643
MD5 a02b76faa7c1b4193be7b334ef4eb14b
SHA1 f338af5aa4a72e9ccd58f7d7ef0715072a46211d
SHA512 4a62866d40b8b999061ecbcae171e0cf55304f773a62ebb3022d32904c24e90af1ab1a9444626cc548f9ea157b6552def3a29eed2e8f98d108ff457229f69cef
TLSH
T16DE086AA3DCDC2AE7695802B1A7C734C8AE13485E7EDAD032701D58522DA604A3D0794
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13431723034606254

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13431723034606254
Size 2KB
SHA256 f22a66061f75b28e03b27eb6303dab086d5e2f9eabba62d19a24a01bb4aea1ed
MD5 819e3dcae9fb55764abf7dcb12ca0c3b
SHA1 ed969baf18438463e5130da1cd23450c5ee4bb3d
SHA512 f94caa08bc78ef7604013d37b1cf3341c7b097e3113e5649b8804748aec00c40d65dff41c1bd79d28376c0d1617296b6af6d7b453798e9955becb18ae91c71f7
TLSH
T1E651A01699D4043EE63F827A91F603EE9EB1BA0130858D1F91A143440E23B467EF1DEF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 89c7a1a325b8ef0fe7d2d8d2d4a0b0d246fc5d3ef75c68ad9f7b4aa0e37a627c
MD5 ef72526db5ee81de979010fbfaf03b71
SHA1 532836b7c1a9aa76a07dd4e1309ed72295b0ab4b
SHA512 422af54d7ceaafd091305075601bf571da2e3530126dca6bd8f799aeba66acf7e2831ed559c74c00feba5b85a59e96e833bc1e21a64ac7d04fc1e1e529361dcc
TLSH
T19CE0DF393BCD876EA0C9A05B6334F34C8AE17401E6FE9D122F04A28462AAA04B282340
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 21KB
SHA256 eaaa8810859373a9c722aee296d8a7df6e608e122e4654706031e73bef79f9c4
MD5 c8341802f19a744837734735d8336e35
SHA1 dc888f0bd3ad016bdc065c945a1cc5a82025813f
SHA512 82f56348c0c9b66099185f46e5413a2e579d23f45cb335d707d473aee8b19642d94f27542a069d24f8c1dbfd5bd062b280f0cc0c60121a35b84b9244dd2e8e3e
SSDEEP 384:KbOpsdGjXbQ2IIIBb5MIMIBbGXMsdG/5whksdGruI6msdGpdGhS:5XbQHbGS
TLSH
T1BBA2C85AD3701B85CCCF97FBBC758C7E07B6DC8944552002A59A57FB2873E0A4AC1B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 0e0b867d6395eddff05d5228bfeb5554a8bdafb86324eaf934a2858e35bf179c
MD5 05190a782492a4f52aad19a5f464c6ed
SHA1 b565b8341d1e4b166d3be4d9437f5450243ebafa
SHA512 41ec1636441d62470658c759900323b57dd6153b7c96f60ae70d41aa5163bf5452faa028a9581c6218509dc96cfcfc06b02a873340c3dd8a33bb2f62f386e027
TLSH
T1AEE086637ECDC2AEB599805B65B8B38C8BD03846FAEAD9476F01C48C6196704A2E4350
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a0ab342efc8158c98a3e3879b83bf1ba25d7cce195ed8e4794b84d32bd447912
MD5 49134f78075e6ca729342e1f2870aada
SHA1 ebf649d18c1eae7d695fec6c6584ae99cfc8930d
SHA512 4435cf6efd93ec63d6c01e3e84868c1b73fb9d7cd3ccfed680f55fec4dc7e08d3093f731c1fef98be8329e639b52e0b064e82cd614d1716f12e1f3b24193d51d
SSDEEP 3072:xTGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:xqm7Rkm1tYpBeh2BAo1
TLSH
T16BC312275E71E9375D79BB4FB08E0B1F1EF149A2C920DE8288D85A0477FA7CD1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 8d08feb06150bcc3a9e9385e1d9a8dcd5e6496f7066ba4846f00e37dbf322f48
MD5 251d0fb52dac312d7fbed62448e5346f
SHA1 4c387f590d459473cd548b82c3db6230a171646c
SHA512 431e8b9ceb69613beeb01b598e10ec8eb5d03079e03c25e5ba5ff4df2d3ff94874c277b3af2be145137eda4f486c0cd6b69ac32145f73ddf62de31ff41e5c2d7
SSDEEP 6144:+BqvL+VRo0AipQNRA8nn0aYHm7Rkm1tYpBeh2BAoa:+oz+oipQzA80a59oBGcAoa
TLSH
T1063412277F65F83B5BADE21AA08F391E1D704D9BDC649DD084EA7A0023E7794066DA30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 b1f5f7b93e5fce0644c9b96ce4a9f2227fcb3b113c9aed4f653d3a1d5818ccd7
MD5 30874e8449cb896ecce849f8b1affc94
SHA1 2f8282aa7e4ceeda03ea13ec197b43d41f9dccbd
SHA512 4f244aeefe17f473939be392e1ab558a63509dcd6af3e265d3a3aa9f5a021b27d37ce158847e6a306357858230cc0b3b5267de05806781c2550d1be3df6be6bb
SSDEEP 6144:9BqvL+VRo0AipQNRA8nn0aYHm7Rkm1tYpBeh2BAoa:9oz+oipQzA80a59oBGcAoa
TLSH
T12E3412277F65F83B5BADE21AA08F391E1D704D9BDC6499D084DA7A0023E7794066DA30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 6abb088d4119f476c287ff6cef1622e1392616ca2e4ce3aa31545573f5d8082e
MD5 b002dab7c851ba26ae911bc0ca286a02
SHA1 c1974ac5e6a19228ac36f73f919a5b05dc44cb4d
SHA512 5471dfdcee461492568d3d4f144bd0c131417c9acccab81e470e4eafda4b9654583e8c7af7328cda0a4789d4b292255cba4b674c4f3773e91142889e52e1e9ab
SSDEEP 6144:fSKqvL+VRo0AipQNRA8nn0aYHm7Rkm1tYpBeh2BAoa:6z+oipQzA80a59oBGcAoa
TLSH
T1073412377F61F83B4BEDA21EA08F350E1DB08D9BDD689D9484D97A4023DB7940A1E930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 9f33a00056c246f52c1d0f14b45ecd9bff3a49bac25c6942b2a3f764d22de3ae
MD5 c72ec3b67f08ce2a857c4623fce122b6
SHA1 69ce88a3ddbfc9f604e2ae51e67f43d726966391
SHA512 0e3d3d88354bb299dd1f228bd5ff16ef44e376ef3ecd0688b83bd6e15aec51569268900cdc63caaa8cd17a7fc8fa7fa80bccec2be9c346404a23d0efed15d26c
SSDEEP 6144:fSKqvL+VRo0AipQNRA8nn0aYHm7Rkm1tYpBeh2BAoa:6z+oipQzA80a59oBGcAoa
TLSH
T18C3412377F61F83B4BEDA21EA08F351E1DB04E9BDD689D9484D97A4023DB7940A1E930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OrbitR.exe

Path C:\Users\Admin\AppData\Local\OrbitR.exe
Size 1.1MB
SHA256 d7e56ec27a3f8ab8c6b81cb146ac41c1e14ef8317dc8680610a9cc906e49d7b2
MD5 6bc2b98cad631e321727a8a0e049498a
SHA1 9758e82fe36d55df726d4afa0e55989ec2a515d0
SHA512 e3bbf585d3d4b26439b9a4572d3f17d1ff756800b3376f64b208d8dfb7b994866197767bfa1587e31a78a4ed8339849e8e62eea492eef439d85212913fe4301c
SSDEEP 12288:UcP8/ti/Kc9L6/Wm/GMKBJK68xHyeQUur/RYiG7jP1Vt9NOSblN+R/2krPjqn6FF:U48F0vL6umGLHgd9EwNIO8+6FSkqq3
TLSH
T133358D607B49D63AEA920173CA7DAB5F211DF5620B2915C3F2CC0AAC5D706D36E3A707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16AE55C.tmp

Path C:\Users\Admin\AppData\Local\Temp\16AE55C.tmp
Size 40B
SHA256 5aab5068640167521851868d880426c6c6b863b716cb41705c993b1ad3677615
MD5 5d1585d02696dfc8a1db69e1a0c97661
SHA1 fad4cc1fed5f13fe4a103799b763e9ab903c4071
SHA512 f144c58f62861545faf0d4976436aa771f972374d89888c825c82eb03045de3fea3b4773f147e5264173ea88789dea696a08c11fe0adbf69ef5fff1838eb8f43
MD5 SHA1 SHA512

Submit Download

362D8B7.tmp

Path C:\Users\Admin\AppData\Local\Temp\362D8B7.tmp
Size 5.4MB
SHA256 676bfe8ff9b1c5a6be04c65448558b7c9ecf8e660b0abf7bad8b4d443322c52d
MD5 6c2b08336eb598bd166190a9cba266f2
SHA1 8af0cab6cfac36424a8bb1a8888a4b6d3f583857
SHA512 7f0710bbaf472bb8b76122c4d90aa3f96bb8dfd7f95660f0db07d6baabf0c6d0132fc2ca56335c2c766f3bc18287475f89738af7926a4364679a9c0770fccc33
SSDEEP 98304:1B7nl94i0nJWFaQRKLj4Qfyjn5WgfyRH1CEnSti2hhrv5POYWKETrY:1B7lgJyQj4nj1yH1rnSt/5PvT
TLSH
T1FC46338F5ADB17A0A9CB677DA237532E00290BAB0B1D4087F3082D4D7D9564B6C496BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

362D8B7.tmp

Path C:\Users\Admin\AppData\Local\Temp\362D8B7.tmp
Size 5.4MB
SHA256 23b0aeaad512ead5cc6ba31956a02055aa4196e31c4a4471725757c5c86da7f8
MD5 f244c970947259d584a7ce86f9cfbbc9
SHA1 1481ef7db59cdd636bb039a2d0b7abbc8fdf486c
SHA512 989cbd781c2f262471b97c525b01cae538025bcd203b924a3397194141a146fe77e29bf46479411bbdc55cd4f14e19252d00249c06ff1d1029a95af763134d13
SSDEEP 98304:Tz7nl94i0nJWFaQRKLj4Qfyjn5WgfyRH1CEnSti2hhrv5POYWKETrY:Tz7lgJyQj4nj1yH1rnSt/5PvT
TLSH
T14146338F5ADF17A069CB677DA237532E00290BAB0B1D4087F3082D4D7D9564B6C4A6BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44D3A2.tmp

Path C:\Users\Admin\AppData\Local\Temp\44D3A2.tmp
Size 40B
SHA256 9c07c93155d4b1cd379647fde2ccc0d70f7664fe79c40d0a90ba9ae894ab44e8
MD5 615b7949297f2e8cc13f723b284b537c
SHA1 1106f3357d5262339543f50f7a64a1772d04874d
SHA512 7e0e719e703cc1640819e502e1d121dea5d6a1047af700e609a2749d88e7f299c708d6e8c2a86f92117e6e393b3d32cf65a0964ae274027f96381f6ff52d2dce
MD5 SHA1 SHA512

Submit Download

B75A6E9.tmp

Path C:\Users\Admin\AppData\Local\Temp\B75A6E9.tmp
Size 15.6MB
SHA256 9e410180c1820b317dbefc31dd9cef868f8983f50aef89ea5f46fea9819b44b5
MD5 1773d8dfbfef05a6376151fd3562d628
SHA1 86792cf93aea89bf7b5c5d5085eae58f25c94fe4
SHA512 771035e943a3a9f81f9401f50b79b0cf1800a203010014f3b7049614edaa50547279cf626e2ecd20a5e9a2e51f2688583f685a8145c8647838252b5b6405d16f
SSDEEP 393216:hlhR1zIoYUIxVijwjd+WaZE/uC90tcWwBtoifDn:FInUPWaZE/Rut0td
TLSH
T155F633FB061C43D17BEF55560894AB6CB104B8EA0178960FA3574ED60B929DBFCE4C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B75A6E9.tmp

Path C:\Users\Admin\AppData\Local\Temp\B75A6E9.tmp
Size 15.6MB
SHA256 300efc7d98370172ee057ddb8027f7e7ad4dd7660ae2cc10cdc362a8be843de4
MD5 376ff58f65c17b45306fee296d08b625
SHA1 4672b12c983b20433ce3e3f3fc9f15f886c8db30
SHA512 5c761818fa09fd1158d427de5e9d4ca3e034d846a913e253deadd6fdfdded2b13b408a9d0aa162671df96a3252d0b61b0e261af293e0fe1944a5406ca8c658f2
SSDEEP 393216:vlhR1zIoYUIxVijwjd+WaZE/uC90tcWwBtoifDn:TInUPWaZE/Rut0td
TLSH
T169F633FB061C43D17BEF55560894AB6CB104B8EA0178960FA3574ED60B929DBFCE4C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebuggerProxy.dll

Path C:\Users\Admin\AppData\Local\Temp\DebuggerProxy.dll
Size 358KB
SHA256 2760521e67d374303447a6d75bf6da7aad6fd0057aed526b163d241ea98acd17
MD5 b2b975f47e8fa68bf5cf4b452b78fcd8
SHA1 3125be67c772dcad88a076f0f0196bd8d440e379
SHA512 f0b64e78c05e4fbbd1ec7fc28c011c531766d28a4a3f469ba51f92600b3db29284a922efeaaad265126cb4c8e41ef43132bee66f337361f80965f50677a0b949
SSDEEP 3072:RyGPDDc3I6S8YtqKOZBeHAUWbvm8/1wRPF2qGatRToxr1M2tbWRLRXMj+VqKzzIO:XcBCmcHbKqGOWr1M2KMjy
TLSH
T1DD74E853F7648438C5AE64369466E334A3682E18B3D076DB9A807794B8B3581EF33FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mss32.dll

Path C:\Users\Admin\AppData\Local\Temp\Mss32.dll
Size 345KB
SHA256 bddb62373f616bf8edd6cfe580d80b2fd0325069f59fbc2b70b2cb0458241926
MD5 ef698a81b3db0654e4ee65a8deaa8a59
SHA1 764826c1b2612ce1ea0b904af63cd1faeb41c87b
SHA512 a96e683d3d3c50dad4d7706a7a7b8a05a6a7ed304971a2cada137a573464396d04675733692aa1d4594cd7ca25e78eaf1e9d26f75c24f4e55053b49c9fdd2695
SSDEEP 6144:spcTapyHuUcl0PUpFawtMR6gP4aHrmtcER3uAy:EIaQ+l0PoVtW6aHrmtcERty
TLSH
T13B745C20764002B6C4E1387BE83E3B39A4BD9F696686116B3545CCAD1E73DE0B74F61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OdRy.7z

Path C:\Users\Admin\AppData\Local\Temp\OdRy.7z
Size 18KB
SHA256 fb1ab9194acd7db55e433afa43bbcd89a94ec35a98392f832c349b2387e9b364
MD5 a1d44a8bd5f2d459ffbd475d9c089af0
SHA1 0e045de82ae0b822c11495ce9fa0c83922c7ef2a
SHA512 b620b35b28119fe1f2cdf02ea755e0ef1c5d33541095cc98cf5f5c8c2cff7c61dbc36e675f9c3cf5b78b5a31dd8d78d931d062d0a7663add90e8b4aa8f31ff7d
SSDEEP 384:r3+ugBTGwD7KyWmtoFYrqjz4wegbZTQAXWf60xXZay9oG:76NxDWmCmFMvXWy0pcG
TLSH
T1BA82E043F1834CDEE9AB15496E707E225F48B533AF0D1EC99C80B3A8A4BC5EE768450C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Runner_Cor.exe

Path C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe
Size 6.0MB
SHA256 e4547515dfa570f2f3450fd83249db59896b0a7896110f2c8897fb3fc9eb9e6e
MD5 d76c8443fc58215fbee97905c056e421
SHA1 8900008928d313cfb472c0a9abb104be3e0db4d8
SHA512 7d04c2b0dc13a22bf1fa6a329842e7ce2afc41c1ff37540d93600d8540f3fb2bf83558b8945da4f8e67c779c31b4d5e80f38c488079fa6d9d7e580ad617cbd0b
SSDEEP 98304:ERAVV/Zj6Uui3jg/MxS/2dStFQ4ldOAQ5i7JSToVE/5l7LBi:GAxj6Uuas/Mxw2gtFQ4ld1rpkz8
TLSH
T117569E21B910C171E6D10132EABD6BBB546C96311B2C10DBE3E45A3AAD705D36F32F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filter_spec.meta

Path C:\Users\Admin\AppData\Local\Temp\filter_spec.meta
Size 26KB
SHA256 54cdf3af232a79976749a7f945b07d45b69bbc69f5efa3c9f30b9ac1149df8fd
MD5 19bd0258d73e7f1795208ee9e1af564a
SHA1 65e8914e54e3cce98b39c84aea29292b1a463fd3
SHA512 dd9674c02ddea8e921869a800c131da6bbcbeb620330d0a99fd1e5ea1d7ead283caea3d7f107403f3d4bebf771e2763ad03b9fe3cb47100a0319db1c58ff0410
SSDEEP 768:n7AD7GCjxI6lOOWhEHagrvVtfNG/ZW+13Og3dR:n8bjxInhE6gQZWy3OqdR
TLSH
T149C29E7E865F8F94A14F983DEC24E0D3C254F1B93D0E256261DA08ABB816DEDC124CA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 485KB
SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
TLSH
T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandbox16.json

Path C:\Users\Admin\AppData\Local\Temp\sandbox16.json
Size 11.7MB
SHA256 61fbc14519c0ada8aeb81b92bb2573ac57dfdd956f88dc4d1fb486a025786980
MD5 bd65369fafb0b4df465e6becffe8d915
SHA1 cc93f4e8c4e7a0a2bd4477ff9cf119f599779105
SHA512 77646380accda7299a20d9db5d4b5350429baeb64c1b74b8c71b6493b7c76ca909b4258c7026bc9f4e7e33eb88a4c2923c6d506cc77533ffb4a3f7bb2e6454aa
SSDEEP 196608:nHGSv6Xpc6NAgLVzCTx6EMomaaYJaZhLCIKt/LcTrLclAWQEV2jiEmDsqxxdGHPp:mSv6Xq6EMlaqrQL+ElAWQSIYIq/dqB
TLSH
T14EC6331D8ACA5766D4B87CB5E24D0B929CEDF4C2CEB05B31AE68C1D520AF04F25493BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandbox16.json

Path C:\Users\Admin\AppData\Roaming\NVIservice_iot\DCNFHTFHQFYN\sandbox16.json
Size 4.7MB
SHA256 431bf199d1b71077278581a453819af78c441c20420fd33ea6e6386bf66c9f60
MD5 b6f2583dfa06c02e3eaa1ad1e1a508d8
SHA1 328d3a644b8793ddc267ee4a12137a534ead3b5f
SHA512 371b770f6019bdd8243dfd2bdcc23c718b0308713b7342cd47eb91ad3a303b7ef3be16a298387569d4097f0086c4f21cc89cd3eb6914b9b98e4edb28bf1a48e5
SSDEEP 98304:hxNYS5a9KuB1zNX/10REQq1F8c+y/qLLgaHY2l9btQR:qGa9KkDX/1lz1iBYUS
TLSH
T12C3623FF9BDA8272E62F07715FC361B7C64EA074C7131781CD05F1836A2BB61A25162A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XRegistry.exe

Path C:\Users\Admin\XRegistry.exe
Size 636KB
SHA256 7783faf41c933a01379be18ac070431c244a95a3bf361897ce471eb4040f63e6
MD5 331bc2bf689bedc4496b06b5d7d47bfa
SHA1 c51dd717b5330b8cd5ea6cc0da8aca60ce985bb9
SHA512 ecb21af850002e17393e9a0b46ac5eeb6e2d4403de406bb9fa243b6375f37a075ff47395211335ec1576ccaf41953972afdabf2803d3d4bca57b86c276a69bb0
SSDEEP 12288:WwvXiMGkWpV1j9hcYtHDlUJNlz9PFu9oT/+2I:WwvizD1fcaDqJP9k9j2I
TLSH
T103D47D0BA3A441F9D0BBE178D9075956F7B6B85603B09B9F23E042672F572A09F7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-124-0x00000000757C0000-0x000000007580F000-memory.dmp

Download

memory/1072-119-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/2056-42-0x00000000757E0000-0x00000000757E1000-memory.dmp

Download

memory/2056-40-0x00000000757C0000-0x000000007580F000-memory.dmp

Download

memory/2056-41-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/2056-43-0x00000000757C0000-0x000000007580F000-memory.dmp

Download

memory/2056-45-0x00000000757C0000-0x000000007580F000-memory.dmp

Download

memory/2056-48-0x00000000757C0000-0x000000007580F000-memory.dmp

Download

memory/2056-61-0x00000000757C0000-0x000000007580F000-memory.dmp

Download

memory/2056-67-0x00000000757E0000-0x00000000757E1000-memory.dmp

Download

memory/2056-68-0x00000000757C0000-0x000000007580F000-memory.dmp

Download

memory/3004-89-0x00007FF7B7650000-0x00007FF7B78B9000-memory.dmp

Download

memory/3004-112-0x00007FF7B7650000-0x00007FF7B78B9000-memory.dmp

Download

memory/3004-108-0x00007FF7B7650000-0x00007FF7B78B9000-memory.dmp

Download

memory/3208-100-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/3208-257-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-337-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-197-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-123-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-92-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-95-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-127-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-235-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-244-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-313-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-312-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-107-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-272-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/3208-169-0x0000000000EF0000-0x0000000001279000-memory.dmp

Download

memory/4316-113-0x0000000000610000-0x0000000000C78000-memory.dmp

Download

memory/4316-90-0x00000000757C0000-0x000000007580F000-memory.dmp

Download

memory/4316-74-0x00000000757C0000-0x000000007580F000-memory.dmp

Download

memory/4316-75-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/4316-77-0x00000000757C0000-0x000000007580F000-memory.dmp

Download

memory/4856-105-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5100-34-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5100-33-0x0000000073810000-0x000000007385F000-memory.dmp

Download