hijackloader | 74a1e4dead91d597b2474e157272794d0c43c877d79565b3ce306331f0bfe8b0

Analysis

max time kernel
300s
max time network
302s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 12.7MB
Sample260820-wpygbasgnd
SHA256 74a1e4dead91d597b2474e157272794d0c43c877d79565b3ce306331f0bfe8b0
MD5 bc1ca24e94b383cc9d341e4e3e88bae3
SHA1 3af49cdb64729c8be2d1ac10aa7106f0492e20d6
SHA512 48f6bb762da740621381b261b6741856b8ad39058b65f0b902b8bb2abff769c0310c12e02674dcfc747751a80364964fa0dd6a7062896dc702dc3e93594dbc16
SSDEEP 393216:+pwU9vgFyZtgHKGy96ys1Jf/3HviCHDn1ASXMyq/s:ewuIgwq4J3/iCHRAgtq/s
TLSH
T1A5D63360739578F8C322903AEF0DE35966F6E3A02B014E9A3BCF1D265E571B1494F4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

e4d12643d44b0f664cb095b3db1c2aa6 credential_access discovery hijackloader vidar loader persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\NVIservice_iot
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

vidar

Version

Botnet

e4d12643d44b0f664cb095b3db1c2aa6

https://62.238.46.160
https://telegram.me/m1duus
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=YmbK
https://steamcommunity.com/profiles/76561198657426610

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral3/files/0x001e00000002b379-29.dat	family_hijackloader
behavioral3/files/0x001900000002b4bd-83.dat	family_hijackloader

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmanager_core.lnk	OrbitR.exe

Executes dropped EXE 3 IoCs

pid	Process
5112	Runner_Cor.exe
856	Runner_Cor.exe
5080	Runner_Cor.exe

Loads dropped DLL 10 IoCs

pid	Process
5112	Runner_Cor.exe
5112	Runner_Cor.exe
856	Runner_Cor.exe
856	Runner_Cor.exe
5080	Runner_Cor.exe
5080	Runner_Cor.exe
2464	XRegistry.exe
3140	OrbitR.exe
1876	memu.exe
4292	memu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	OrbitR.exe
File opened for modification	C:\Program Files\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\desktop.ini	OrbitR.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1679180529-4058988202-686829476-1000\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	OrbitR.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1679180529-4058988202-686829476-1000\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	OrbitR.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2464	XRegistry.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 856 set thread context of 2464	856	Runner_Cor.exe	84
PID 5080 set thread context of 3140	5080	Runner_Cor.exe	85
PID 856 set thread context of 1876	856	Runner_Cor.exe	86
PID 5080 set thread context of 4292	5080	Runner_Cor.exe	87
PID 3140 set thread context of 4168	3140	OrbitR.exe	90
PID 3140 set thread context of 1220	3140	OrbitR.exe	104
PID 3140 set thread context of 4168	3140	OrbitR.exe	90
PID 3140 set thread context of 5064	3140	OrbitR.exe	110

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.scale-125_contrast-white.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\dom\isVirtualElement.js	OrbitR.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\In.ps1	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingNews_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\NewsAppList.scale-125.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.scale-100_contrast-black.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-32_contrast-white.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-1679180529-4058988202-686829476-1000-MergedResources-0.pri	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\safeSetTimeout.js	OrbitR.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\vi-VN\PAD.Console.Host.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64_altform-unplated.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-lightunplated_contrast-black.png	OrbitR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache.scale-200.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-48_altform-unplated.png	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\WindowsBase.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-20_altform-lightunplated_contrast-black.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-lightunplated_contrast-white.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.targetsize-72_altform-unplated.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-80_altform-unplated_contrast-white.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\Facepile.js	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\CameraSplashScreen.scale-125.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\MapsLargeTile.scale-125.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_2020.901.1724.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	OrbitR.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\MSFT_PackageManagementSource.strings.psd1	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REPLTMPL.CFG	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.scale-125.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WeatherAppList.targetsize-64_altform-unplated_contrast-white.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateSquare50x50Logo.scale-400.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\WeatherLargeTile.scale-125.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TipsLargeTile.scale-125_contrast-black.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-72_altform-lightunplated_contrast-white.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-96.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-20_altform-lightunplated.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-16.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-125.png	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.scale-140.png	OrbitR.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleUtilRT.winmd	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\avdevice-58_ms.dll	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-150.png	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll	OrbitR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\BLUECALM.INF	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\contrast-black\MicrosoftSolitaireLargeTile.scale-200_contrast-black.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubAppList.targetsize-32_altform-unplated.png	OrbitR.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\corerunner.job	memu.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrbitR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4556	chrome.exe
3564	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317230271224187"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3140	OrbitR.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5112	Runner_Cor.exe
856	Runner_Cor.exe
856	Runner_Cor.exe
856	Runner_Cor.exe
856	Runner_Cor.exe
5080	Runner_Cor.exe
5080	Runner_Cor.exe
5080	Runner_Cor.exe
5080	Runner_Cor.exe
2464	XRegistry.exe
2464	XRegistry.exe
2464	XRegistry.exe
2464	XRegistry.exe
2464	XRegistry.exe
2464	XRegistry.exe
1876	memu.exe
1876	memu.exe
1876	memu.exe
1876	memu.exe
1876	memu.exe
1876	memu.exe
1876	memu.exe
1876	memu.exe
4292	memu.exe
4292	memu.exe
4292	memu.exe
4292	memu.exe
4292	memu.exe
4292	memu.exe
4292	memu.exe
4292	memu.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
4168	chrome.exe
4168	chrome.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe
3140	OrbitR.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3140	OrbitR.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
856	Runner_Cor.exe
5080	Runner_Cor.exe
856	Runner_Cor.exe
5080	Runner_Cor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeDebugPrivilege	3140	OrbitR.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe
Token: SeCreatePagefilePrivilege	4168	chrome.exe
Token: SeShutdownPrivilege	4168	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 5112	984	Setup.exe	81
PID 5112 wrote to memory of 856	5112	Runner_Cor.exe	82
PID 856 wrote to memory of 5080	856	Runner_Cor.exe	83
PID 856 wrote to memory of 2464	856	Runner_Cor.exe	84
PID 856 wrote to memory of 2464	856	Runner_Cor.exe	84
PID 5080 wrote to memory of 3140	5080	Runner_Cor.exe	85
PID 856 wrote to memory of 1876	856	Runner_Cor.exe	86
PID 5080 wrote to memory of 3140	5080	Runner_Cor.exe	85
PID 856 wrote to memory of 1876	856	Runner_Cor.exe	86
PID 5080 wrote to memory of 4292	5080	Runner_Cor.exe	87
PID 5080 wrote to memory of 4292	5080	Runner_Cor.exe	87
PID 4168 wrote to memory of 1976	4168	chrome.exe	91
PID 4168 wrote to memory of 3348	4168	chrome.exe	92
PID 4168 wrote to memory of 3348	4168	chrome.exe	92
PID 4168 wrote to memory of 4556	4168	chrome.exe	93
PID 4168 wrote to memory of 4492	4168	chrome.exe	95
PID 4168 wrote to memory of 4492	4168	chrome.exe	95
PID 4168 wrote to memory of 1232	4168	chrome.exe	99
PID 4168 wrote to memory of 1232	4168	chrome.exe	99
PID 4168 wrote to memory of 4516	4168	chrome.exe	96
PID 4168 wrote to memory of 4516	4168	chrome.exe	96
PID 4168 wrote to memory of 3588	4168	chrome.exe	97
PID 4168 wrote to memory of 3588	4168	chrome.exe	97
PID 4168 wrote to memory of 2448	4168	chrome.exe	100
PID 4168 wrote to memory of 2448	4168	chrome.exe	100
PID 4168 wrote to memory of 3480	4168	chrome.exe	101
PID 3140 wrote to memory of 4168	3140	OrbitR.exe	90
PID 3140 wrote to memory of 4168	3140	OrbitR.exe	90
PID 3140 wrote to memory of 4168	3140	OrbitR.exe	90
PID 3140 wrote to memory of 4168	3140	OrbitR.exe	90
PID 3140 wrote to memory of 4168	3140	OrbitR.exe	90
PID 3140 wrote to memory of 1220	3140	OrbitR.exe	104
PID 3140 wrote to memory of 1220	3140	OrbitR.exe	104
PID 3140 wrote to memory of 1220	3140	OrbitR.exe	104
PID 3140 wrote to memory of 1220	3140	OrbitR.exe	104
PID 3140 wrote to memory of 1220	3140	OrbitR.exe	104
PID 3140 wrote to memory of 1220	3140	OrbitR.exe	104
PID 3140 wrote to memory of 4168	3140	OrbitR.exe	90
PID 3140 wrote to memory of 4168	3140	OrbitR.exe	90
PID 3140 wrote to memory of 4168	3140	OrbitR.exe	90
PID 3140 wrote to memory of 4168	3140	OrbitR.exe	90
PID 3140 wrote to memory of 4168	3140	OrbitR.exe	90
PID 4168 wrote to memory of 4444	4168	chrome.exe	107
PID 4168 wrote to memory of 2820	4168	chrome.exe	108
PID 4168 wrote to memory of 1768	4168	chrome.exe	109
PID 3140 wrote to memory of 5064	3140	OrbitR.exe	110
PID 3140 wrote to memory of 5064	3140	OrbitR.exe	110
PID 3140 wrote to memory of 5064	3140	OrbitR.exe	110
PID 3140 wrote to memory of 5064	3140	OrbitR.exe	110
PID 3140 wrote to memory of 5064	3140	OrbitR.exe	110
PID 3140 wrote to memory of 5064	3140	OrbitR.exe	110
PID 4168 wrote to memory of 3564	4168	chrome.exe	112
PID 4168 wrote to memory of 2636	4168	chrome.exe	113
PID 4168 wrote to memory of 2080	4168	chrome.exe	114
PID 4168 wrote to memory of 2080	4168	chrome.exe	114

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe
  "C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\ProgramData\NVIservice_iot\Runner_Cor.exe
    C:\ProgramData\NVIservice_iot\Runner_Cor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Users\Admin\AppData\Roaming\NVIservice_iot\KCPKONFHCTO\Runner_Cor.exe
      C:\Users\Admin\AppData\Roaming\NVIservice_iot\KCPKONFHCTO\Runner_Cor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:5080
    - - C:\Users\Admin\AppData\Local\OrbitR.exe
        
        C:\Users\Admin\AppData\Local\OrbitR.exe
        5⤵
        Creates a file in the Startup directory
        Loads dropped DLL
        Drops desktop.ini file(s)
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3140
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:1220
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Roaming\defender_kernel\memu.exe
        
        C:\Users\Admin\AppData\Roaming\defender_kernel\memu.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4292
  - - C:\Users\Admin\XRegistry.exe
      C:\Users\Admin\XRegistry.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:2464
  - - C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
      C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:4580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdabeac728,0x7ffdabeac734,0x7ffdabeac740
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,17256317833117914006,1761509358193899465,262144 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,8345919138731153343,5660742735059532367,524288 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,10763414689542977048,5241528536397919417,524288 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:13
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2992,i,14342011991422110708,18326455493536474049,2097152 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3028 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2996,i,7885912577161358417,2039010343589058429,2097152 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4064,i,15174968691250194627,10552271197847737267,2097152 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4080 /prefetch:9
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,17980487778412614296,14010240237282594770,2097152 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,7149132753676126076,14136852426236755243,524288 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,5595964421523771452,10023217117547132087,524288 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,11809009620872018748,7818381578615643784,524288 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,786200940771151231,11487203640682049903,524288 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,779724716945518332,17488667999838158103,524288 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5768,i,9519642029978614728,18088676733267924791,262144 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4108 /prefetch:10
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,9371775364741252589,2858489581482619053,524288 --field-trial-handle=1856,i,428131274773542514,12654111360881751980,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:14
  2⤵
  PID:2080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bccb87d1a9e64dd4d11c2ffb5f211d719eb437c4

Path C:\ProgramData\Jovise\Cusak\bccb87d1a9e64dd4d11c2ffb5f211d719eb437c4
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

Defuto

Path C:\ProgramData\Jovise\Defuto
Size 6KB
SHA256 d71675ee1a8b1af34c7323639ef1e0eb27ed234e8c5fdbd636cb16e9d63d8e74
MD5 50092334b278b606e400400f7ca1ea5d
SHA1 a135ed82942ae590fbc132c3c34d3b56fa3f0630
SHA512 324ff1ed53a64eed2faeca1169eb57f12d60608e75cf9b67b7458fa44137eae4585ff749d8af5223fa89a4434a83e0cefd62ba966fb1782ccd2fae0614a1671e
SSDEEP 96:UHtPC3zpRR+gQ9NVarCpswld5CxUoN1MDaAKwiapa25iIenucHgySQZXzmt0ra7x:waj1ia2uAKrjIeulQZXN2Qm
TLSH
T1EED1AF6A776D756A69A7860C12F1632BC097BFA446810ECB6B2F8D779DC4243CD38481
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fivutake

Path C:\ProgramData\Jovise\Fivutake
Size 3KB
SHA256 4392e2dc32025580e2eb9834abe3ee9e96f302e83aed37b2db5d3c6cea4326e5
MD5 d333846bf8a34668d7b7d18655806da0
SHA1 5234a8c9160b9fb24150ea9d2667cc0b83fc717b
SHA512 8f02c5356c41b47b9f2d3d54503192e95244166d9340545e031f9f15c9c0abbd78bc0c95de9475bdba4beea70e1a9c0ef2f2b72a1f6c88b1428cc166cfa9a338
TLSH
T115515C2088CB2B3F1073046BEA76101BE451D495992722FAAAD35776A321974A82D8D2
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1dbd88a6f2babfa749fcbb6de43618403750793cd7e91a4696160d2d2a9bd008
MD5 6d8f9760a9151cb038068b1020fc32ec
SHA1 b6380d3cecadd1b189ab9a8d7fa8f32ff9e0ed6f
SHA512 ef96db1e1ca6243ec80f76abcaf3eaba6ea536ea5483320f788f9f6f609ed8cd715efb1b22c5baa85755bea39b7195f68a125767b3c7fcb55d8573023b1e2b1b
TLSH
T1DDE02BBACA11AC3B1CFC075894544A47DF5123662750494F3B3D411D8FB26768596D1C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 16KB
SHA256 660e1e12d095210d8efcc7dad96124e9c671f556b0c8b26bae095325866b3332
MD5 575c4f194af8805f7f3d228ea95cb818
SHA1 9168a0300a8215ac29e994104d728d6d95c26c32
SHA512 dd6454288701a279d1734e4723ba518bca7af84351986002eb4c76ecbcf2693e3d65ebf20ae9e5dce501b053805978ba9bde41991a2f8c29acd11db3c8a31352
SSDEEP 3:OlH/lyuJ7ltym94i7l/kH1Xaabglllq2VD1sqK1caaulxymOW/jylwXaKVq2upvX:KguJhAah/4Ml/7VDI0TGjawZ7ul
TLSH
T16A7212AB99682D60C1C5D27EDE5293806312BE484319CE01959D4AF09034B803DFEAE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 d22d9dcd17677382be5995d1cec956a8bf4318763393d628fd9f2a50e8e8b11c
MD5 d7fad16de1ea50402d4587b6f98af4c8
SHA1 5995a0fa35d2ed272bf308e8c9dabf3e7bf3e9a7
SHA512 756782d12463c9d39afb8db59bec031573e8c54353bb252d80a28c8b19308c3e3e3261291bf5455b7f6937b93a470408a8ffc2865340d1bf46879e2cae753f37
TLSH
T190E086C93ACDC1ADA49584779378734CCFD03949A7C9BC032F059884719150462E5350
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 1KB
SHA256 be29c9fc0351c85916b386f4bc3ddf9e3c80e9942192c30aa2bb66a838d6894f
MD5 880ac6030409c1119fe5789d188618a2
SHA1 c8326954b9c9efc8c36b95313bd01bc24fe7c11e
SHA512 3bbbf2ff22c3daa2b59cafdd2e19b043d43f499b4f4b028239376eee38e990b4728b24f0fe844feaad447fbc9695f5b0e1951aeb692d3a948d557faf81a3c994
TLSH
T1CF31EBC93B806647EF2ACC796CA1A3232FA0D1E4065848E21BF419A52CCB990662B5CD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 308B
SHA256 e8e6691e6b3d0bc4caca866684e721670bed49d6e52bb316778db1f465801e85
MD5 6bbbb131202ec712507d38631900b9e4
SHA1 8b443bd4913a5a6d0e6e0b3df69229efe92656aa
SHA512 0d5193c5378aa7956f9e244d55161ab123b228b215c52e401317ee3f6b116ea7b9fcd74c88d8c53095de920ec53496d3ed747949ba7ee4b71bc90c5e8dc1f9e2
TLSH
T1A6E0CD8B39DED26E648980571374B34ECAE43C48DEDE9C4317007444B2C5904A7E1353
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d42418f67fa7ef70600a52772622aab243c94932d34105deaa1a664fd308dbb1
MD5 2f9e4b937354b32b4027c2d602a91c17
SHA1 8ec859b7c0cd3aa65376119fdc280e9a600a6302
SHA512 eb5ada4503ee491f492c84b618e0ad9688d4937c89ba3e91ce47bbb497891a6c803ea09b7ebf221e6e61fe873d57df3bd8fe7cedeb664aa1dd0e46069be62aaa
TLSH
T10E518DF7D3E49A6D851156F4DB116E1FCE290A14131C3C6289D4AF5B53E2872D20174E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 972e137f7404dd05413aa898178571563fbda13cfb3364824fb2bc528efc3b27
MD5 3794a93a84e918013dc0fde80cbf1e9b
SHA1 e73805e4a82d025011a6957075a52ed2b6ef21fe
SHA512 fba5426504c8c66292cc231e22132c2ee8464f297ab1ec5b2169e29b00b987f0ceb5d558d8417990791645918034138cbdd761a45ff2f69064f87c2e9d85f423
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoOT:OIEumQv8m1ccnvS6CG
TLSH
T1BAF2E1FF07197601C0E49675D6810ECFFD2D051D8B9BBEC09AAC09F3AB865B3A538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3641b1c5fc73cd5ec5acaba71f9ea282b4baba9249f4048571bfd241e562bbea
MD5 bb816713b545179022285ff525bc056c
SHA1 11d6f7cb6ba876eff82b27705389389b5fcd9fc1
SHA512 8fc704117d62676425a41d05e441c6e677fba72fb8156747be5f5bb11ebb75de6552ab3c170cd7bc90b359bb48dc6cf69c8e9264e740ddeb471a643b6d3e15eb
SSDEEP 192:3R+TD194vdN7qv7sBpAPRp2Z9NHsb+WNnJu0sA8L2fekweVyIsnAUgtaJ:3RUBKm8UXerw00t8L2fe28
TLSH
T11D42B72EBE10647B5CDFD229FD22BB53D7F5202121951E84EAFC892C15E79CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 718eb549a227d7026da73c294acdb2dd98a17f60203dfcb802340947f4583027
MD5 29f1684cc4575bdf44dbb8ba104925e0
SHA1 4865307aaa394ca4fabe4308a482e17da679b642
SHA512 0a4abbe63226d752fbba1844c5f452884b519014c6015319388e5bafe176e9406498de6b5d62f0fa699c3ace3e0fd3e9ddef70242576d0d73a83e2fa3382d357
TLSH
T1AAB0124080419111C05306FC2142248C721D9F10DA0B2F0583E179228C351508014050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cc9d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59cc9d.TMP
Size 96B
SHA256 f0be5cd30304881bbb87557105a143181a5bfa86f07de1ed61d7e74d1703e98f
MD5 ab8939271860448178fab3562eb72564
SHA1 6ae274767b76531f292cea8a681226102e234e32
SHA512 f1a33dfd63e3c397f435191c0c478d22483689c9dd517d70f06666058594a158e5b7832ee8dc8210deed3e100bfd5d25e7c4ebc8e496c4b8d98df9596f6420e2
TLSH
T158B0220AC0022222C00303B0A88080C8B0A0CF28CA0303ABE2E00EA2EC32B200C28030
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 f043a078a578d7bebf5713d07568dbf98c2169fe032e593c8ce72e6eae668368
MD5 6af29bcdf14a0b0c56634661d92331d7
SHA1 46e597da631a843c964022c2544163620aa0e969
SHA512 9dda1409df8a3f36d3c699eec5c15c748821a54015755b73301523f99c4e0303e89b07691847f18a8795ec9c21dae8dbef8980aeabecc38b40af27986cedd976
SSDEEP 6144:UqvL+VRo0AipQNRA8nn0aYbm7Rkm1tYpBeh2BAoa:9z+oipQzA80ax9oBGcAoa
TLSH
T1AD3412277F65F83B57EDE21AA08F350E1DB04D9BDC6899D484D97A0023E7794076EA30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 c89741c2ccf0cfb351ce257740ff4cb3752f7d48a638d432fc895183d230cc9d
MD5 04bdf1f7acf94b17d6d2af1d28234d65
SHA1 0d862c0389abfa79128218019f0ff215171a1ba7
SHA512 49f6ece4ab82654ce1714032e7e59464d7f60dc85cea77e849b2f985e8601a0f13aa743a05f0fbae34ff5ec132792c66c9990fbdd95cb46aa3df164bef35ab9f
SSDEEP 6144:KqvL+VRo0AipQNRA8nn0aYbm7Rkm1tYpBeh2BAoa:Pz+oipQzA80ax9oBGcAoa
TLSH
T1B73412377F65F83B5BFDA219A08F350E1DB04D9BDC6899D488D97A0023E67944B2E930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 e240df5ddfdcb7169a88ebadcb35259bd93025d3f786b5d42082dc6e9d26b794
MD5 cb0f55678535354c29d04aaddc271188
SHA1 4aae72d39b1c272c9c86e8a22d2a4c1b9fc797c4
SHA512 a579912a56586f37d1a2cfd5edd8c60ef3f725a68831d29da858c4ff57715d774587890a76ca2eb70ad466e6c7cbbd3e2e580b598b9996227938f3740167a5b1
SSDEEP 6144:nqvL+VRo0AipQNRA8nn0aYbm7Rkm1tYpBeh2BAoa:qz+oipQzA80ax9oBGcAoa
TLSH
T1703412277F65F83B57EDE21AA08F350E1DB04D9BDC6899D484D97A0023E7794076EA30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9e3ba8c7a6b70ff03b8db9c060cb8f0219ea34017c6487dd385bababf32a82d0
MD5 595a5a1673f821bcaac2e856aba8841a
SHA1 f920e9ec82cebb847e273a74395bf86b65084250
SHA512 7bcd6a8adc695c537b8dbfeb324ae87dcf0556fbe7a5d0a51d9ebe63f4e22ad3ff9fb60d4ded1c50b2ba536df062fe4b35d6162e2920e403b1081bd6968c5701
SSDEEP 3072:xGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:gm7Rkm1tYpBeh2BAoe
TLSH
T18FC312375E75A97759B9B70EB08E0B1F1EF14EA6C920DE82C8D85B0427EA7CC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 19f7f24548c759fe0dbd00441fc0cf703e2ad11cb39d5bd2044ede8e03623b87
MD5 67899eb1a0712458facd924be1270275
SHA1 b2b6be2af35bd34fb41be59b01bbb1dc3d815ce8
SHA512 342c75de381f3791c5f3f1a9333e46000425b9bd9003d0b6de113037a494c19f0757d61bfb1b051c587d741264907458b797413a3f3f9af342ba816c92884b31
SSDEEP 6144:yqvL+VRo0AipQNRA8nn0aYbm7Rkm1tYpBeh2BAoa:Xz+oipQzA80ax9oBGcAoa
TLSH
T1DE3412377F65F83B5BFDA219A08F350E1DB04D9BDC6899D488D97A0023E67944B2E930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OrbitR.exe

Path C:\Users\Admin\AppData\Local\OrbitR.exe
Size 1.1MB
SHA256 d7e56ec27a3f8ab8c6b81cb146ac41c1e14ef8317dc8680610a9cc906e49d7b2
MD5 6bc2b98cad631e321727a8a0e049498a
SHA1 9758e82fe36d55df726d4afa0e55989ec2a515d0
SHA512 e3bbf585d3d4b26439b9a4572d3f17d1ff756800b3376f64b208d8dfb7b994866197767bfa1587e31a78a4ed8339849e8e62eea492eef439d85212913fe4301c
SSDEEP 12288:UcP8/ti/Kc9L6/Wm/GMKBJK68xHyeQUur/RYiG7jP1Vt9NOSblN+R/2krPjqn6FF:U48F0vL6umGLHgd9EwNIO8+6FSkqq3
TLSH
T133358D607B49D63AEA920173CA7DAB5F211DF5620B2915C3F2CC0AAC5D706D36E3A707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ae5-524e-7ff2-db56.tmp

Path C:\Users\Admin\AppData\Local\Temp\1ae5-524e-7ff2-db56.tmp
Size 18KB
SHA256 be175b4fe1466ca0fb3d763ec67d92968a08324d9fd1f89f6f871926954b2cfa
MD5 fee5edf7e7f64de44b1588650ee4c05b
SHA1 7f83e8b34c45149da9c17df1200cb0af8bf53cfe
SHA512 d22171e1ee51d9a21d86c2bc7b3a58d426d4907dba0ac17df5e21316b4d959ee5d2ce3a925269beae0b3c1e45c7c844da7f49d409ec9fef3238e1096df358c11
SSDEEP 384:8bMShWAeK8YClzBWjHd4wQUWlY0ZJaA8SSxj/mOnbRsKfFDLcGe2u5egY:8bMSMAeK8DWzmZTXZJSxbmOnVsKfFDLf
TLSH
T1D782E07448AB956EC7CFC06FE888DC3E05E689262C4FEFC5406740DE1AE312E5147A76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6EC8B05.tmp

Path C:\Users\Admin\AppData\Local\Temp\6EC8B05.tmp
Size 15.6MB
SHA256 d9636e32c3b41876fb613a7efd39eea2dd058e7fe5f0472edea6ee88a94c6259
MD5 878219de024c4e110503392bde74c9d6
SHA1 0ff6d659edac1306d92779f3df90264de52c7c1b
SHA512 30a3d0833b0835eb5823b6e4d05d56b47549849518f9628d2d436e9c8b9b80a8f0e9775e6891c7b725170ad23d6fb162988bc9328c0d99d9de6c8e34ab3f9033
SSDEEP 393216:uA95NKxhf2W9IVJU5cXHGDoi1EYTYfKRWWxd/UvUl:z97KxgW9ITU5cXHGsRYWKwWxFd
TLSH
T181F633F83ECB8585432C950894BC81B5A6BC2DE03AF13D5A3AC35F54DA974F69039AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6EC8B05.tmp

Path C:\Users\Admin\AppData\Local\Temp\6EC8B05.tmp
Size 15.6MB
SHA256 c1d8bca0c39a504a6e30a6809373474495c54a21d2446b49ca4149ececeb1eec
MD5 cde633368148f0791eb511632c6355e1
SHA1 799a56ff4e4cd9525b836753bfeb954207a49417
SHA512 ffd877c5946bcf76f12739c7832f3fc5cbddaf96f762497112935b5d1817b75ef7b28ce907faae8811a1956e1486be0bb3e56078eb3d113cd8443f9fe320192f
SSDEEP 393216:sd95NKxhf2W9IVJU5cXHGDoi1EYTYfKRWWxd/UvUl:Q97KxgW9ITU5cXHGsRYWKwWxFd
TLSH
T14AF633F83ECB8585432C950894BC81B5A6BC2DE03AF13D5A3AC35F54DA974F69039AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C0BC0BB.tmp

Path C:\Users\Admin\AppData\Local\Temp\C0BC0BB.tmp
Size 5.4MB
SHA256 fee25941a8337e59c6fd169596c2424fa7130b3a0e73c7a90ee79648150add52
MD5 711eebf032434a946b79eb30a57154da
SHA1 9c50f515443719332cdf9d0a60fe110fd30dbda9
SHA512 dc61415862d1f78617dcc04ae454dafe0bf2f569380dabc85b7f4b452254da7823d8599e7327cab81a372ca09a2633cf92f2e90ce30e395a1a05f058dca3c52f
SSDEEP 98304:i0jL5VO2K06RsDbfGRMJaINPOyzFqYCfd0PWu80q5u8DpyP:iA+I6RsDbORMJaIN2yzifd0PXJ
TLSH
T1FF463391EB86D59E73D76E89457F0427FEE253FA6185102A1B3308216DEC0E8E74E1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C0BC0BB.tmp

Path C:\Users\Admin\AppData\Local\Temp\C0BC0BB.tmp
Size 5.4MB
SHA256 361be5885101d2dfcdf53336782c5e401939e1876cc6141ee22e83e92fa2a1a0
MD5 fb00408e8f67eab3d9f1bd64003956a6
SHA1 e1f790e24eeb1a5ae559370470e3835d91a258d6
SHA512 9ae8ef9ba7396b99dc49d449c8dbd0f121c7616340dc25a6b847d314929b73c558d2ca0686e0c6371411950264651f8432575be5ece78e078e6317f19ab2cc58
SSDEEP 98304:c0jA5VO2K06RsDbfGRMJaINPOyzFqYCfd0PWu80q5u8DpyP:c7+I6RsDbORMJaIN2yzifd0PXJ
TLSH
T150463391EB86D59E73D76E89457F0427FEE253FA6185102A1B3308216DEC0E8E74E1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C9FC6C8.tmp

Path C:\Users\Admin\AppData\Local\Temp\C9FC6C8.tmp
Size 40B
SHA256 7fc29270e98b221816273fe6d915d189848d5c4e36b1bce9985d330b6a379f1e
MD5 b418fe7ebfa638a2defddc82138cc79c
SHA1 a5aab2688f33a4b29ee779dd7fa18734a16ce5d1
SHA512 2aa5a707663494492a8c7047fe5dacf2c54c42eecac3ace7b614ee366185a21da04da8f5dc8cdc485f93fc962efc1821b8c1803d2e0169b30cfd7a62d4013a11
MD5 SHA1 SHA512

Submit Download

DebuggerProxy.dll

Path C:\Users\Admin\AppData\Local\Temp\DebuggerProxy.dll
Size 358KB
SHA256 2760521e67d374303447a6d75bf6da7aad6fd0057aed526b163d241ea98acd17
MD5 b2b975f47e8fa68bf5cf4b452b78fcd8
SHA1 3125be67c772dcad88a076f0f0196bd8d440e379
SHA512 f0b64e78c05e4fbbd1ec7fc28c011c531766d28a4a3f469ba51f92600b3db29284a922efeaaad265126cb4c8e41ef43132bee66f337361f80965f50677a0b949
SSDEEP 3072:RyGPDDc3I6S8YtqKOZBeHAUWbvm8/1wRPF2qGatRToxr1M2tbWRLRXMj+VqKzzIO:XcBCmcHbKqGOWr1M2KMjy
TLSH
T1DD74E853F7648438C5AE64369466E334A3682E18B3D076DB9A807794B8B3581EF33FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EB5DCA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\EB5DCA1.tmp
Size 40B
SHA256 7defeacd47ab2601badba4cd96cadaaca9bf58f6f0157a0a3cb91dd82c3a1bb9
MD5 2279f8e5e44b1b429734f1d560f1688e
SHA1 c235460bc832a51881da64527894ab3e3b6c583b
SHA512 743d779f1f2272534c06bff712ffdb209613dc12c0a4f1e4c8853edf8e507eaf4964911ab170b6e65aabbdace3e39507e10f05c70b2c8318ac4034553666e166
MD5 SHA1 SHA512

Submit Download

Runner_Cor.exe

Path C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe
Size 6.0MB
SHA256 e4547515dfa570f2f3450fd83249db59896b0a7896110f2c8897fb3fc9eb9e6e
MD5 d76c8443fc58215fbee97905c056e421
SHA1 8900008928d313cfb472c0a9abb104be3e0db4d8
SHA512 7d04c2b0dc13a22bf1fa6a329842e7ce2afc41c1ff37540d93600d8540f3fb2bf83558b8945da4f8e67c779c31b4d5e80f38c488079fa6d9d7e580ad617cbd0b
SSDEEP 98304:ERAVV/Zj6Uui3jg/MxS/2dStFQ4ldOAQ5i7JSToVE/5l7LBi:GAxj6Uuas/Mxw2gtFQ4ld1rpkz8
TLSH
T117569E21B910C171E6D10132EABD6BBB546C96311B2C10DBE3E45A3AAD705D36F32F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filter_spec.meta

Path C:\Users\Admin\AppData\Local\Temp\filter_spec.meta
Size 26KB
SHA256 54cdf3af232a79976749a7f945b07d45b69bbc69f5efa3c9f30b9ac1149df8fd
MD5 19bd0258d73e7f1795208ee9e1af564a
SHA1 65e8914e54e3cce98b39c84aea29292b1a463fd3
SHA512 dd9674c02ddea8e921869a800c131da6bbcbeb620330d0a99fd1e5ea1d7ead283caea3d7f107403f3d4bebf771e2763ad03b9fe3cb47100a0319db1c58ff0410
SSDEEP 768:n7AD7GCjxI6lOOWhEHagrvVtfNG/ZW+13Og3dR:n8bjxInhE6gQZWy3OqdR
TLSH
T149C29E7E865F8F94A14F983DEC24E0D3C254F1B93D0E256261DA08ABB816DEDC124CA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mss32.dll

Path C:\Users\Admin\AppData\Local\Temp\mss32.dll
Size 345KB
SHA256 bddb62373f616bf8edd6cfe580d80b2fd0325069f59fbc2b70b2cb0458241926
MD5 ef698a81b3db0654e4ee65a8deaa8a59
SHA1 764826c1b2612ce1ea0b904af63cd1faeb41c87b
SHA512 a96e683d3d3c50dad4d7706a7a7b8a05a6a7ed304971a2cada137a573464396d04675733692aa1d4594cd7ca25e78eaf1e9d26f75c24f4e55053b49c9fdd2695
SSDEEP 6144:spcTapyHuUcl0PUpFawtMR6gP4aHrmtcER3uAy:EIaQ+l0PoVtW6aHrmtcERty
TLSH
T13B745C20764002B6C4E1387BE83E3B39A4BD9F696686116B3545CCAD1E73DE0B74F61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 485KB
SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
TLSH
T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandbox16.json

Path C:\Users\Admin\AppData\Local\Temp\sandbox16.json
Size 11.7MB
SHA256 61fbc14519c0ada8aeb81b92bb2573ac57dfdd956f88dc4d1fb486a025786980
MD5 bd65369fafb0b4df465e6becffe8d915
SHA1 cc93f4e8c4e7a0a2bd4477ff9cf119f599779105
SHA512 77646380accda7299a20d9db5d4b5350429baeb64c1b74b8c71b6493b7c76ca909b4258c7026bc9f4e7e33eb88a4c2923c6d506cc77533ffb4a3f7bb2e6454aa
SSDEEP 196608:nHGSv6Xpc6NAgLVzCTx6EMomaaYJaZhLCIKt/LcTrLclAWQEV2jiEmDsqxxdGHPp:mSv6Xq6EMlaqrQL+ElAWQSIYIq/dqB
TLSH
T14EC6331D8ACA5766D4B87CB5E24D0B929CEDF4C2CEB05B31AE68C1D520AF04F25493BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandbox16.json

Path C:\Users\Admin\AppData\Roaming\NVIservice_iot\KCPKONFHCTO\sandbox16.json
Size 4.7MB
SHA256 431bf199d1b71077278581a453819af78c441c20420fd33ea6e6386bf66c9f60
MD5 b6f2583dfa06c02e3eaa1ad1e1a508d8
SHA1 328d3a644b8793ddc267ee4a12137a534ead3b5f
SHA512 371b770f6019bdd8243dfd2bdcc23c718b0308713b7342cd47eb91ad3a303b7ef3be16a298387569d4097f0086c4f21cc89cd3eb6914b9b98e4edb28bf1a48e5
SSDEEP 98304:hxNYS5a9KuB1zNX/10REQq1F8c+y/qLLgaHY2l9btQR:qGa9KkDX/1lz1iBYUS
TLSH
T12C3623FF9BDA8272E62F07715FC361B7C64EA074C7131781CD05F1836A2BB61A25162A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XRegistry.exe

Path C:\Users\Admin\XRegistry.exe
Size 636KB
SHA256 7783faf41c933a01379be18ac070431c244a95a3bf361897ce471eb4040f63e6
MD5 331bc2bf689bedc4496b06b5d7d47bfa
SHA1 c51dd717b5330b8cd5ea6cc0da8aca60ce985bb9
SHA512 ecb21af850002e17393e9a0b46ac5eeb6e2d4403de406bb9fa243b6375f37a075ff47395211335ec1576ccaf41953972afdabf2803d3d4bca57b86c276a69bb0
SSDEEP 12288:WwvXiMGkWpV1j9hcYtHDlUJNlz9PFu9oT/+2I:WwvizD1fcaDqJP9k9j2I
TLSH
T103D47D0BA3A441F9D0BBE178D9075956F7B6B85603B09B9F23E042672F572A09F7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/856-71-0x0000000074D80000-0x0000000074DCF000-memory.dmp

Download

memory/856-52-0x0000000074DA0000-0x0000000074DA1000-memory.dmp

Download

memory/856-51-0x00007FFDCB380000-0x00007FFDCB589000-memory.dmp

Download

memory/856-50-0x0000000074D80000-0x0000000074DCF000-memory.dmp

Download

memory/856-60-0x0000000074D80000-0x0000000074DCF000-memory.dmp

Download

memory/856-59-0x0000000074D80000-0x0000000074DCF000-memory.dmp

Download

memory/856-54-0x0000000074D80000-0x0000000074DCF000-memory.dmp

Download

memory/856-77-0x0000000074D80000-0x0000000074DCF000-memory.dmp

Download

memory/856-79-0x0000000074DA0000-0x0000000074DA1000-memory.dmp

Download

memory/1876-115-0x00007FFDCB380000-0x00007FFDCB589000-memory.dmp

Download

memory/2464-130-0x00007FF71C4D0000-0x00007FF71C739000-memory.dmp

Download

memory/2464-120-0x00007FF71C4D0000-0x00007FF71C739000-memory.dmp

Download

memory/2464-103-0x00007FF71C4D0000-0x00007FF71C739000-memory.dmp

Download

memory/3140-327-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-105-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-335-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-131-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-206-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-204-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-118-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-372-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-110-0x00007FFDCB380000-0x00007FFDCB589000-memory.dmp

Download

memory/3140-337-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-227-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-258-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-170-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-295-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-102-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/3140-346-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/4292-126-0x00007FFDCB380000-0x00007FFDCB589000-memory.dmp

Download

memory/4292-132-0x0000000074D80000-0x0000000074DCF000-memory.dmp

Download

memory/5080-117-0x0000000000790000-0x0000000000DF8000-memory.dmp

Download

memory/5080-87-0x0000000074D80000-0x0000000074DCF000-memory.dmp

Download

memory/5080-85-0x00007FFDCB380000-0x00007FFDCB589000-memory.dmp

Download

memory/5080-84-0x0000000074D80000-0x0000000074DCF000-memory.dmp

Download

memory/5080-100-0x0000000074D80000-0x0000000074DCF000-memory.dmp

Download

memory/5112-31-0x00007FFDCB380000-0x00007FFDCB589000-memory.dmp

Download

memory/5112-30-0x0000000072D10000-0x0000000072D5F000-memory.dmp

Download