hijackloader | 74a1e4dead91d597b2474e157272794d0c43c877d79565b3ce306331f0bfe8b0

Analysis

max time kernel
300s
max time network
301s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 12.7MB
Sample260820-wpygbasgnd
SHA256 74a1e4dead91d597b2474e157272794d0c43c877d79565b3ce306331f0bfe8b0
MD5 bc1ca24e94b383cc9d341e4e3e88bae3
SHA1 3af49cdb64729c8be2d1ac10aa7106f0492e20d6
SHA512 48f6bb762da740621381b261b6741856b8ad39058b65f0b902b8bb2abff769c0310c12e02674dcfc747751a80364964fa0dd6a7062896dc702dc3e93594dbc16
SSDEEP 393216:+pwU9vgFyZtgHKGy96ys1Jf/3HviCHDn1ASXMyq/s:ewuIgwq4J3/iCHRAgtq/s
TLSH
T1A5D63360739578F8C322903AEF0DE35966F6E3A02B014E9A3BCF1D265E571B1494F4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

e4d12643d44b0f664cb095b3db1c2aa6 credential_access discovery hijackloader vidar loader persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\NVIservice_iot
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

vidar

Version

Botnet

e4d12643d44b0f664cb095b3db1c2aa6

https://62.238.46.160
https://telegram.me/m1duus
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=YmbK
https://steamcommunity.com/profiles/76561198657426610

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral4/files/0x000d00000001c52e-27.dat	family_hijackloader
behavioral4/files/0x000c00000001c548-72.dat	family_hijackloader

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmanager_core.lnk	OrbitR.exe

Executes dropped EXE 3 IoCs

pid	Process
1188	Runner_Cor.exe
2692	Runner_Cor.exe
3056	Runner_Cor.exe

Loads dropped DLL 10 IoCs

pid	Process
1188	Runner_Cor.exe
1188	Runner_Cor.exe
2692	Runner_Cor.exe
2692	Runner_Cor.exe
3056	Runner_Cor.exe
3056	Runner_Cor.exe
5696	XRegistry.exe
2876	memu.exe
5532	OrbitR.exe
4448	memu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	OrbitR.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	OrbitR.exe
File opened for modification	C:\Program Files\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	OrbitR.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	OrbitR.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	OrbitR.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	OrbitR.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	OrbitR.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	OrbitR.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5696	XRegistry.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2692 set thread context of 5696	2692	Runner_Cor.exe	96
PID 2692 set thread context of 2876	2692	Runner_Cor.exe	97
PID 3056 set thread context of 5532	3056	Runner_Cor.exe	98
PID 3056 set thread context of 4448	3056	Runner_Cor.exe	99
PID 5532 set thread context of 1852	5532	OrbitR.exe	104
PID 5532 set thread context of 2096	5532	OrbitR.exe	126
PID 5532 set thread context of 1852	5532	OrbitR.exe	104
PID 5532 set thread context of 5128	5532	OrbitR.exe	139

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.POWERPNT.16.1033.hxn	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-processthreads-l1-1-1.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png	OrbitR.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui	OrbitR.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	OrbitR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL	OrbitR.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo	OrbitR.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\chocolateyInstall.ps1	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\WindowsFormsIntegration.resources.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.CO.ID.XML	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\SKY.INF	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecurityLargeTile.scale-100_contrast-white.png	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\wmpnscfg.exe.mui	OrbitR.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\In.Tests.ps1	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.JP.XML	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Grid.Base.dll	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Xml.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-white_scale-80.png	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecuritySmallTile.scale-400_contrast-white.png	OrbitR.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\Example3B.Diagnostics.Tests.ps1	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.X509Certificates.dll	OrbitR.exe
File opened for modification	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms	OrbitR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml	OrbitR.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\af-ZA\tipresx.dll.mui	OrbitR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll	OrbitR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	OrbitR.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\corerunner.job	memu.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4704	2692	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrbitR.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4232	chrome.exe
816	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317230370906490"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5532	OrbitR.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1188	Runner_Cor.exe
2692	Runner_Cor.exe
2692	Runner_Cor.exe
2692	Runner_Cor.exe
2692	Runner_Cor.exe
3056	Runner_Cor.exe
3056	Runner_Cor.exe
3056	Runner_Cor.exe
3056	Runner_Cor.exe
5696	XRegistry.exe
5696	XRegistry.exe
5696	XRegistry.exe
5696	XRegistry.exe
5696	XRegistry.exe
5696	XRegistry.exe
2876	memu.exe
2876	memu.exe
2876	memu.exe
2876	memu.exe
2876	memu.exe
2876	memu.exe
2876	memu.exe
2876	memu.exe
4448	memu.exe
4448	memu.exe
4448	memu.exe
4448	memu.exe
4448	memu.exe
4448	memu.exe
4448	memu.exe
4448	memu.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
1852	chrome.exe
1852	chrome.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe
5532	OrbitR.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5532	OrbitR.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2692	Runner_Cor.exe
2692	Runner_Cor.exe
3056	Runner_Cor.exe
3056	Runner_Cor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeDebugPrivilege	5532	OrbitR.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5664 wrote to memory of 1188	5664	Setup.exe	89
PID 1188 wrote to memory of 2692	1188	Runner_Cor.exe	90
PID 2692 wrote to memory of 3056	2692	Runner_Cor.exe	92
PID 2692 wrote to memory of 5696	2692	Runner_Cor.exe	96
PID 2692 wrote to memory of 5696	2692	Runner_Cor.exe	96
PID 2692 wrote to memory of 2876	2692	Runner_Cor.exe	97
PID 2692 wrote to memory of 2876	2692	Runner_Cor.exe	97
PID 3056 wrote to memory of 5532	3056	Runner_Cor.exe	98
PID 3056 wrote to memory of 5532	3056	Runner_Cor.exe	98
PID 3056 wrote to memory of 4448	3056	Runner_Cor.exe	99
PID 3056 wrote to memory of 4448	3056	Runner_Cor.exe	99
PID 1852 wrote to memory of 5636	1852	chrome.exe	105
PID 1852 wrote to memory of 4232	1852	chrome.exe	107
PID 1852 wrote to memory of 3616	1852	chrome.exe	108
PID 1852 wrote to memory of 3616	1852	chrome.exe	108
PID 1852 wrote to memory of 4900	1852	chrome.exe	109
PID 1852 wrote to memory of 4900	1852	chrome.exe	109
PID 1852 wrote to memory of 4320	1852	chrome.exe	110
PID 1852 wrote to memory of 5848	1852	chrome.exe	111
PID 1852 wrote to memory of 4320	1852	chrome.exe	110
PID 1852 wrote to memory of 5848	1852	chrome.exe	111
PID 1852 wrote to memory of 5668	1852	chrome.exe	112
PID 1852 wrote to memory of 5668	1852	chrome.exe	112
PID 5532 wrote to memory of 1852	5532	OrbitR.exe	104
PID 5532 wrote to memory of 1852	5532	OrbitR.exe	104
PID 5532 wrote to memory of 1852	5532	OrbitR.exe	104
PID 5532 wrote to memory of 1852	5532	OrbitR.exe	104
PID 5532 wrote to memory of 1852	5532	OrbitR.exe	104
PID 1852 wrote to memory of 720	1852	chrome.exe	113
PID 1852 wrote to memory of 5656	1852	chrome.exe	115
PID 1852 wrote to memory of 5656	1852	chrome.exe	115
PID 1852 wrote to memory of 2224	1852	chrome.exe	116
PID 1852 wrote to memory of 2224	1852	chrome.exe	116
PID 1852 wrote to memory of 3080	1852	chrome.exe	120
PID 1852 wrote to memory of 2780	1852	chrome.exe	121
PID 1852 wrote to memory of 3080	1852	chrome.exe	120
PID 1852 wrote to memory of 2780	1852	chrome.exe	121
PID 1852 wrote to memory of 3312	1852	chrome.exe	122
PID 1852 wrote to memory of 3296	1852	chrome.exe	123
PID 1852 wrote to memory of 3312	1852	chrome.exe	122
PID 1852 wrote to memory of 3296	1852	chrome.exe	123
PID 1852 wrote to memory of 5680	1852	chrome.exe	124
PID 1852 wrote to memory of 5680	1852	chrome.exe	124
PID 1852 wrote to memory of 1824	1852	chrome.exe	125
PID 1852 wrote to memory of 1824	1852	chrome.exe	125
PID 5532 wrote to memory of 2096	5532	OrbitR.exe	126
PID 5532 wrote to memory of 2096	5532	OrbitR.exe	126
PID 5532 wrote to memory of 2096	5532	OrbitR.exe	126
PID 5532 wrote to memory of 2096	5532	OrbitR.exe	126
PID 5532 wrote to memory of 2096	5532	OrbitR.exe	126
PID 5532 wrote to memory of 2096	5532	OrbitR.exe	126
PID 1852 wrote to memory of 1592	1852	chrome.exe	128
PID 1852 wrote to memory of 1592	1852	chrome.exe	128
PID 1852 wrote to memory of 5388	1852	chrome.exe	129
PID 1852 wrote to memory of 5388	1852	chrome.exe	129
PID 1852 wrote to memory of 484	1852	chrome.exe	130
PID 1852 wrote to memory of 484	1852	chrome.exe	130
PID 1852 wrote to memory of 5416	1852	chrome.exe	131
PID 1852 wrote to memory of 5416	1852	chrome.exe	131
PID 1852 wrote to memory of 5632	1852	chrome.exe	132
PID 1852 wrote to memory of 2132	1852	chrome.exe	133
PID 1852 wrote to memory of 5632	1852	chrome.exe	132
PID 1852 wrote to memory of 2132	1852	chrome.exe	133
PID 5532 wrote to memory of 1852	5532	OrbitR.exe	104

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5664
- C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe
  "C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\ProgramData\NVIservice_iot\Runner_Cor.exe
    C:\ProgramData\NVIservice_iot\Runner_Cor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Users\Admin\AppData\Roaming\NVIservice_iot\YCPNRJNJUIY\Runner_Cor.exe
      C:\Users\Admin\AppData\Roaming\NVIservice_iot\YCPNRJNJUIY\Runner_Cor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Users\Admin\AppData\Local\OrbitR.exe
        
        C:\Users\Admin\AppData\Local\OrbitR.exe
        5⤵
        Creates a file in the Startup directory
        Loads dropped DLL
        Drops desktop.ini file(s)
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5532
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:2096
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Roaming\defender_kernel\memu.exe
        
        C:\Users\Admin\AppData\Roaming\defender_kernel\memu.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 648
      4⤵
      Program crash
      PID:4704
  - - C:\Users\Admin\XRegistry.exe
      C:\Users\Admin\XRegistry.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:5696
  - - C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
      C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 240 -p 2692 -ip 2692
1⤵
PID:2772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:3104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ff89372c728,0x7ff89372c734,0x7ff89372c740
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1400,i,14932901142325439489,10458274026506593830,524288 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,16914149552105574747,3262896312852017783,262144 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,1902448131729914510,4504051362850942370,524288 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,15715925132116177893,17876842609985448978,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,8098355518283497740,6470263296983605501,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4648,i,9735861468509375664,14902474700571961986,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,353801019213705488,2126003605924764588,524288 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5828,i,12270810773531991938,13894485953777329250,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5864,i,17885882137449327956,4699698612507818185,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5860,i,9528951090432569779,7043325950021958705,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6152,i,13034554570803222167,9445639621694358760,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5824,i,9800361496812964882,1692972939551578891,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6116,i,3877884073526226477,5076669300562326472,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5972,i,12253072504524281061,2957229242035233753,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5888,i,15438638802251978063,10807989396076792996,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,14289334738856019653,15711094294248784937,524288 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,4853392061446871775,11010562027421421605,524288 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,186342556755484013,3800110194093901586,524288 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6416,i,11867839838974870327,9292489632649945819,524288 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5856,i,2962420513079305224,4699106312549550166,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:9
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5716,i,8617513691785506753,16217307133963486259,2097152 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,1083952818321562600,7474583171384513694,524288 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,17252243667707482928,10319177849022563881,524288 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,4642418464646952836,6365101228472573570,524288 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1400,i,13464086949090779203,17064777668245485362,524288 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:11
  2⤵
  - System Time Discovery
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3836,i,15723087801738943604,12348057899414508154,262144 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:10
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6320,i,784939254341829346,5635975363182287576,524288 --field-trial-handle=2432,i,15909570179465280331,16884938702599843156,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  PID:5076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

420ffd6d602acf35fd83bf5037fb8e1d01ff4481

Path C:\ProgramData\Jovise\Cusak\420ffd6d602acf35fd83bf5037fb8e1d01ff4481
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

Defuto

Path C:\ProgramData\Jovise\Defuto
Size 6KB
SHA256 04e328cdc4465692ff5382f33b2018f662d277a766fe2747783787390803489b
MD5 b8e1c625c612edb2098532c9846f92f8
SHA1 a87ecb4debf7e4c4f436b521a12555827ed644c4
SHA512 60b30a464a4a7aebd96c5238cca6fb12b348427272fc6f651a2db4452a7d02ea8faf80516d7daac5c74a43db776d48f34df9a266c257e52b8a1ea6d07a8fe8ad
SSDEEP 192:Cdk6aE0mCk4vo4G3voNHp6y3H44boaDPso/wT8HxnbfsEFd6no:KUmCk4A4NNHpxY4bRDPRHxnjsAd6o
TLSH
T1D5D1AF66A171852FE4C5C8C402E58EB27730670E650B2C2F64D3ABD7E92672722B8D77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fivutake

Path C:\ProgramData\Jovise\Fivutake
Size 3KB
SHA256 e8b425e8aacf34cff412a0aaae8c33b9c01a6202741e540db6edc7236dc1c887
MD5 97b4c050a95f63e1ada710ea6c7bc167
SHA1 404f1843c9210346e6408ad27e760606af759f38
SHA512 35f8371f9fb9746381ce9102e931a946f89d6e6c53239d9e71c6f8da6633a332ea68c3a1138038a673f46c85aa524dd5728e683ec942085312c493c2ce69aef2
TLSH
T173513BEA1F15002D52D5B6E3826AC3C5A938FAE22028BD726E03AE579C061FF5D430C4
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 38ee677071e0546e9fbf65525e242d62b15a3d4ea1d6b9d398dd9e1c73c3df3a
MD5 301dc637a377e75e6500ceccce77121a
SHA1 fe7737d27550b2204acd2916037f333cf3cf42d4
SHA512 efe5fb46e83d289c0930c2a8bbbe7dcae56c6e4d9567d5fd408d21c6f76cacea67d953b378d07b2b5133132769183acc1c6224dfd3ed387591f32b49307bcb94
TLSH
T13531BCFBD3E4957D8A4156F4AB156F1FCE2A0514031C38A6C8E46F2B93E2971D10469F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 af53b48b2d9b31d3a510149142421ddd14b3cf19f02fc27bb04267a07b8faf82
MD5 ed14f2d263f7ff7f716089e84a34c2cb
SHA1 67ac6405c8fdc6c1ca3f0239c2406eb1e4fa896d
SHA512 3d45306d85182f653d0cf72854c0415071847eecd942e0ab7c60fd8b2832b6fbc7823fc31db56bca68b10a0a10e9e5a959d4c233ef75e2767b89e614ce438b47
SSDEEP 192:URn7Crkv7hAPRp2l98Hsb+WNnU70BkJpWASkwKflVyIsnAUgR:URn7KAAXauwI02JpWhqbR
TLSH
T10032862EBA14697B5CDAD229FD317753E3F5102221D01E84EBFC8A6C15E79CC222751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ab5d7c49158998a10bd386e7eee59f5400b5624c5f00523efd491fdcf18418d3
MD5 c49cdb31636c6fc41287b3356c073103
SHA1 482809200658fbb3c4bfb73e1da0e78b8cffe975
SHA512 3090a73370db7b4f98659497e9393f432e8d1390cf17eb59362f5d661387c55f3493b70969600de5321e4fe74308735a5d870d290e9779e8aba4914261addbe8
SSDEEP 192:URn7Mrkv7h5PRpYl98Hsb+WNnU70QkJpWASkwFflVyIsnAUgE:URn7YA7XMuwI0pJpWhlbE
TLSH
T16642B82EB914797B6CDBD229F9257B53D3F5102121E02E84EBFC8A2C15E75CC222711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ceac4d38467cbca754d4dbe505be0a5f98752390bd8e070f27b9b0e8394b1b8c
MD5 deb42e0340395dd129e32da0acb8d715
SHA1 ca722815eaf68c3be1b2a1f359b35c76fed2f4f1
SHA512 69f098a6035dd96cfeeec6799765531c2aa8d80130e7a656369051333cdad8f73879b5251d766f0224420a2691578462ba2318862f36eef3b9385915ae4602e5
SSDEEP 192:URn7Crkv7h5PRpYl98Hsb+WNnU70QkJpWASkwFflVyIsnAUgE:URn7KA7XMuwI0pJpWhlbE
TLSH
T11B42B82EB914797B6CDBD229F9257B53E3F5102121E02E84EBFC8A2C15E75CC222711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e854ca2044ef6518ae7e9a6cef7e28c3e1aba066377ff502bd05bf072f9e42e6
MD5 c0f24b416750031b2c57ac0330d0de60
SHA1 efa8dd16f61833efc07ce1400ecd4f2e4fdfe4b5
SHA512 09cc20d1db0564500b840a3df8b06caece010a1e3735f06f3ccb5f55ecbc0f303946ee920b8ce2c5282509c4c6a8fdcc415f0d8a51f390cfc8bbf4d197365eb1
TLSH
T109A002509FC00512CE40737360E2458522A24914196D430355D104448D6B7C07172136
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 135c0b224dfe4c52b13e7ab6b2735aa933bae087c2159385051c2cc9617800f9
MD5 4e986754bbae1ed88579d3c1cfc2acb2
SHA1 454fd2bcb52dde92659311f2396c88293ee771fd
SHA512 5a100bcde3c0297fbc966983712da5f25c462c518a95d77d1355cc1e3e3501cfbe5de3c77b690b9e52f90dacda6436c75e5cd3269487817e49ff1c928bab01e6
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b9b7020b-c6dd-46ba-a47a-fa398da4cacc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b9b7020b-c6dd-46ba-a47a-fa398da4cacc.tmp
Size 11KB
SHA256 48cbcc88875a7e40f96f5d34c4b47658bad92859246ba43e3509fc84d9a873d6
MD5 3f09074df2208ff0b0fb67eb67589e3d
SHA1 f444901a792b995ca0e4dc3f3e77449b6b15f7f4
SHA512 b4b506ccc7962e7b505271459f0c8ee556d2d7f0743cfe7d1462e6df75110546d1d9288138a978d17f1ab763803edd941d6e39ebcca28b5ca8491f950b297943
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKNdrtumtK7rx:Majm97KxkXqKf/pUZNCgVLH2HfgslN1N
TLSH
T12E32D827A48D9E7F0FD8D518CC136F8B6CF5429262780D2896FB9D0803A578E114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 13b5052ec484d0f2a5df2f632a9dd75bb1dc350e79e1df643ebae9316b4a491b
MD5 024f6d29be60fe6cf535910b87858ad3
SHA1 e21aa302bf608f94452f51d8ca10dd69cec62365
SHA512 4aecd741cdbb62df1514e587813231b75394b796e1872ce2dbb04f4e1141fcfa3e0f061cfd6d4d585643bf5e048f1ebab81dffc0a0a21a3350d77d17d7bab788
SSDEEP 3072:1goMMKfFse9kbuOUCauAMxFfQdrRMAQ8eSMiN01ZW05:2jkp9pQNRA8eEqZW05
TLSH
T15DD31221AD39AD336DC3C652B25BBD5ACCE4357314EE1AC8456CA7A181E32D50F36C72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 85042d7c81d5f5891417cdf9870001e0ca1a0e1425a8db1a17a82d46da6a0aa9
MD5 d7aedd25c863ecb2aed31a7be198336e
SHA1 2fa4708751cdfd9fb95355c6f8914ea389083f69
SHA512 17c4f56ed90d28df71f4ca6e8834f935de4ce6c618a6eade70e2fbf437e1f6248a7669d7c623d66cffa73963a340ccaa08de66633c592b4074f421f9cd2eafcd
SSDEEP 3072:nagoMMKfFse9kbuOUCauAMxFfQdrRMAQ8eSMiN01ZW05:Xjkp9pQNRA8eEqZW05
TLSH
T12DD31232AD2969376D93C591724BBD5ACCE8357718ED2BCC452CBB9181E32990E33C72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 740cbcf20c2a06a3b5870dc13cc80908c9cd33b1e71a63e5bced2c7eaa00e463
MD5 7c3bfdaa03afa633fb8cf784cfca8678
SHA1 1b8e94491b4900820bd4f95ac385d4598b1f2749
SHA512 aa7ba196d3f53da7ed001aef038fcd6e3985e633ab36228f745108a22ae7f7b104d57fc28eea7bca6c27108459a91d2bcd07081248a1cf3261cce86cf726b7cb
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5KHDINB6eGyvkonYob1v4a:MC0HJm5FHuPgXDUDIITW8nYobZ
TLSH
T1AAA12AB1A4A94CB759B7D345F8826A83DEE4A2276990EF80D9DD1F0C01F31E81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 a9276389adde25dde53dfa67e16a1c6396212a41f5ce6884fc9e6b39fd371f9d
MD5 166ab8e4ca74a58c161a3f056cc3ec67
SHA1 7ddd3c6f3c2a101e21ccdb05ea0ea8ac1006a6d8
SHA512 852bfc2caf61500fcc6dfa0a4bb243a7d2708d2a0040977dd1fafa6174041e76a21e9c8f8a2a0b6b78063a57fa86e0c014c324d94b36f2bc7fd5dc96fa23ab2c
SSDEEP 3072:sgoMMKfFse9kbuOUCauAMxFfQdrRMAQ8eSMiN01ZW05:pjkp9pQNRA8eEqZW05
TLSH
T1F2D31221AD39AD336DC3C652B25BBD5ACCE4357314EE1AC8466CA7A181E32D50F36C72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 c16bf8ecae867231608ffec0a16c9c63dbf85584359024fffa74803d1e1885fe
MD5 5e91227edd2e7a9485d7461cc235e86e
SHA1 6087c5212c4f506a1c11b2745afdd04433e4f5cc
SHA512 3ac5e512e399fae61ead621fddc060080d26c497e25e1428d93375c6b65a9f0bbc01167d8c02ed14012e5a4817fa2ab05df9f1ccf4a5943f08c3ce2627acd43f
SSDEEP 3072:0goMMKfFse9kbuOUCauAMxFfQdrRMAQ8eSMiN01ZW05:hjkp9pQNRA8eEqZW05
TLSH
T14CD31221AD39AD336DC3C652B25BBD5ACCE4357314EE1AC8456CA7A181E32D50F36C72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 134c7fc0435ed1687a1c822ad55751e26dc47548133652ed8dda4c0e39ab321b
MD5 7f413e7c81340e07e8fae48448b6c7be
SHA1 a237f7e39081405bf0fc95a7774eb5fb73394b1c
SHA512 f3357776bc6e00b580e35238431a4e8146793c42099454dbe33284f1faefe53cd778de3b89064269aeb9955e24dbe480802e259615031ebac41f53d9fec5a751
SSDEEP 3072:zagoMMKfFse9kbuOUCauAMxFfQdrRMAQ8eSMiN01ZW05:Tjkp9pQNRA8eEqZW05
TLSH
T1EED31232AD296D372D93C591724BBD5ACCE8357718ED2BCC452CBB9181A32950E37C72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OrbitR.exe

Path C:\Users\Admin\AppData\Local\OrbitR.exe
Size 1.1MB
SHA256 d7e56ec27a3f8ab8c6b81cb146ac41c1e14ef8317dc8680610a9cc906e49d7b2
MD5 6bc2b98cad631e321727a8a0e049498a
SHA1 9758e82fe36d55df726d4afa0e55989ec2a515d0
SHA512 e3bbf585d3d4b26439b9a4572d3f17d1ff756800b3376f64b208d8dfb7b994866197767bfa1587e31a78a4ed8339849e8e62eea492eef439d85212913fe4301c
SSDEEP 12288:UcP8/ti/Kc9L6/Wm/GMKBJK68xHyeQUur/RYiG7jP1Vt9NOSblN+R/2krPjqn6FF:U48F0vL6umGLHgd9EwNIO8+6FSkqq3
TLSH
T133358D607B49D63AEA920173CA7DAB5F211DF5620B2915C3F2CC0AAC5D706D36E3A707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3B5C3C5.tmp

Path C:\Users\Admin\AppData\Local\Temp\3B5C3C5.tmp
Size 40B
SHA256 20e06561eb8b326e31a66df628c6a7865b5c2cd620e9aca4de9a19a0057f93a5
MD5 96863b4e9518c9f7ea65f1e5fd0144c4
SHA1 445f7bfc6b213601dd2d7fcf52211082f475b5d1
SHA512 4b0b9c2e29b9b9a8e3edd5ec0c732d706278d0e93f6ad36065f4b66e77c09033b27ef88488c369f9c33af03af5a4bdbb83e43d3c0df68f02dddffb91d56165e2
MD5 SHA1 SHA512

Submit Download

42EC8B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\42EC8B5.tmp
Size 5.4MB
SHA256 b6f81afe7e65e1137bf3356e57706406c243577c700feebb54d07ac7837cad00
MD5 285bcfe30f1ddcd2f66123bbc30cb3f3
SHA1 14718e6ad4b4d87da17789c668895bd1b037fbfe
SHA512 32984961dfc724d23ee247ef6e4b38f707e4fbeab251509e1fc35ca61c8c6c32cdc34e0c052b912d4f7b8a3555100c08b7f9d464fb0a204a451bba039a06d1a8
SSDEEP 98304:E28ubIg/+tRFVMkN7RiVpi19E7g/U5RkrJppA7GAUboWv22S6h1Apn8/VgopRJmJ:ELux/6MkvG62g/dJpGioW86hin8/VgQO
TLSH
T198463349F7D4826A7723DCC32E6FCB24B179CA93989D40DE05829583E65EB0F2D0BD94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42EC8B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\42EC8B5.tmp
Size 5.4MB
SHA256 3119998fce4188de1c888093d56a52e3c26e970b07e86cff2acde50516695e5f
MD5 4889881a452a8dd2dfd28e8eb913fb67
SHA1 1c8dcca014e9c067e819de0bfded2bb2dae42788
SHA512 f1e37466f34b716aebd3f2615879d1897dfbc655aaf9127da3ef6dbe0254bf21de4eda5c9c8c6f35b2d647f8f2213b638bd20dcdf5083fdf82057ac25ee9f527
SSDEEP 98304:NJ8ubIK/+tRFVMkN7RiVpi19E7g/U5RkrJppA7GAUboWv22S6h1Apn8/VgopRJmJ:NWu7/6MkvG62g/dJpGioW86hin8/VgQO
TLSH
T167463349F7D4826A7723DCC32E6FCB24B179CA93989D40DE05829583E65EB0F2D0BD94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

893F6CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\893F6CC.tmp
Size 40B
SHA256 bae18a552a4b5d6618eda9d98c90680d7b50e44f5c1f13585288ad6e16e32c15
MD5 f6e1520764a1a942971e777c48a28011
SHA1 ee7fe5418a4cffa52385d623b1dec2a58afc3e48
SHA512 5f894075c3a3a6f10c7826412eb7dfffa57729010f276f21b81fc6b9520ab55d481c52e1e1d3d4fafa0b65ec31bdc96193e0ea097a45efb61690752ad0176119
MD5 SHA1 SHA512

Submit Download

DebuggerProxy.dll

Path C:\Users\Admin\AppData\Local\Temp\DebuggerProxy.dll
Size 358KB
SHA256 2760521e67d374303447a6d75bf6da7aad6fd0057aed526b163d241ea98acd17
MD5 b2b975f47e8fa68bf5cf4b452b78fcd8
SHA1 3125be67c772dcad88a076f0f0196bd8d440e379
SHA512 f0b64e78c05e4fbbd1ec7fc28c011c531766d28a4a3f469ba51f92600b3db29284a922efeaaad265126cb4c8e41ef43132bee66f337361f80965f50677a0b949
SSDEEP 3072:RyGPDDc3I6S8YtqKOZBeHAUWbvm8/1wRPF2qGatRToxr1M2tbWRLRXMj+VqKzzIO:XcBCmcHbKqGOWr1M2KMjy
TLSH
T1DD74E853F7648438C5AE64369466E334A3682E18B3D076DB9A807794B8B3581EF33FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9D8E5B.tmp

Path C:\Users\Admin\AppData\Local\Temp\E9D8E5B.tmp
Size 15.6MB
SHA256 dd047d52dc91d0ee6c49c0ac0cde589e6002ce7dffeccd5caf5ed7d6bb46aa23
MD5 c0223a5374fcdfcbcb4d6767ea3877f3
SHA1 c733db84a22405f3c73db2aef93da0b2582734a9
SHA512 9cfdf8bec9b15e6f0f2a8b9874f2902d88481296d711bf935fcc8b194fd2b6f91789142d009d4b1bf9002c92c95a07d5e9cc2cfc3dc071151f6cb9fb517f1bd8
SSDEEP 393216:SuRFgt5fiO413+hgEOMtGaD8WFGQVzunC+V1fWAfx:SEFgt5ishgEhtGU4wzKC+V1Fx
TLSH
T14FF633B6988FD6E93F56B0F1AC86C034DD48BCD572B8F214B9C0E452DC0583E9697D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9D8E5B.tmp

Path C:\Users\Admin\AppData\Local\Temp\E9D8E5B.tmp
Size 15.6MB
SHA256 4db49a37ac9623a839158f3c15e90bb1a498377b3b7e8c568c6fcba3263b9841
MD5 76743bbc49b3671c889b2da0b190f3d8
SHA1 b19879d4228c0c20e0b6bc8b966c6442739d39ab
SHA512 5485ac2b44e2182547aab9ef8de2b9d21869b94a150962605895cffc0e3cc6da320218628a11b6d2edd5b71132d17fbe064f8af4e87b8017ee6d2b5f910ca2c8
SSDEEP 393216:AuzFgt5fiO413+hgEOMtGaD8WFGQVzunC+V1fWAfx:AuFgt5ishgEhtGU4wzKC+V1Fx
TLSH
T1CBF633B6988FD6E93F56B0F1AC86C034DD48BCD572B8F214BAC0E452DC0583E9697D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HRa1st.7z

Path C:\Users\Admin\AppData\Local\Temp\HRa1st.7z
Size 14KB
SHA256 f4938299ca2488f18c317a88f63a7bce6099a9ec7252516d0934c437b7fb30be
MD5 28e8deed0ce04e65aa27605fe6100de3
SHA1 7a424689631de27739b9b56464e155740dda5a6b
SHA512 4c15dba5a8f0a9703c2a53261f93f5c0cb7ae03844e35c38483c7057be73b47be8297b7ce3b15c46c8d9a29ca74644d5e8016994015378d5403fab4d4729fca6
SSDEEP 384:zs/WVK9A4gkT729XdeA6QxSlzQPsUHZ+4saR/ZWTnIYBFQzLk5S8Caslf:zs/HMkX2KtOS+PsKrR/wIYr2kc
TLSH
T10162C052C625695F362E3CBB4F0E5A069A43CD038A3E8295E7F7F24E583ED4F2170428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Runner_Cor.exe

Path C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe
Size 6.0MB
SHA256 e4547515dfa570f2f3450fd83249db59896b0a7896110f2c8897fb3fc9eb9e6e
MD5 d76c8443fc58215fbee97905c056e421
SHA1 8900008928d313cfb472c0a9abb104be3e0db4d8
SHA512 7d04c2b0dc13a22bf1fa6a329842e7ce2afc41c1ff37540d93600d8540f3fb2bf83558b8945da4f8e67c779c31b4d5e80f38c488079fa6d9d7e580ad617cbd0b
SSDEEP 98304:ERAVV/Zj6Uui3jg/MxS/2dStFQ4ldOAQ5i7JSToVE/5l7LBi:GAxj6Uuas/Mxw2gtFQ4ld1rpkz8
TLSH
T117569E21B910C171E6D10132EABD6BBB546C96311B2C10DBE3E45A3AAD705D36F32F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filter_spec.meta

Path C:\Users\Admin\AppData\Local\Temp\filter_spec.meta
Size 26KB
SHA256 54cdf3af232a79976749a7f945b07d45b69bbc69f5efa3c9f30b9ac1149df8fd
MD5 19bd0258d73e7f1795208ee9e1af564a
SHA1 65e8914e54e3cce98b39c84aea29292b1a463fd3
SHA512 dd9674c02ddea8e921869a800c131da6bbcbeb620330d0a99fd1e5ea1d7ead283caea3d7f107403f3d4bebf771e2763ad03b9fe3cb47100a0319db1c58ff0410
SSDEEP 768:n7AD7GCjxI6lOOWhEHagrvVtfNG/ZW+13Og3dR:n8bjxInhE6gQZWy3OqdR
TLSH
T149C29E7E865F8F94A14F983DEC24E0D3C254F1B93D0E256261DA08ABB816DEDC124CA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mss32.dll

Path C:\Users\Admin\AppData\Local\Temp\mss32.dll
Size 345KB
SHA256 bddb62373f616bf8edd6cfe580d80b2fd0325069f59fbc2b70b2cb0458241926
MD5 ef698a81b3db0654e4ee65a8deaa8a59
SHA1 764826c1b2612ce1ea0b904af63cd1faeb41c87b
SHA512 a96e683d3d3c50dad4d7706a7a7b8a05a6a7ed304971a2cada137a573464396d04675733692aa1d4594cd7ca25e78eaf1e9d26f75c24f4e55053b49c9fdd2695
SSDEEP 6144:spcTapyHuUcl0PUpFawtMR6gP4aHrmtcER3uAy:EIaQ+l0PoVtW6aHrmtcERty
TLSH
T13B745C20764002B6C4E1387BE83E3B39A4BD9F696686116B3545CCAD1E73DE0B74F61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 485KB
SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
TLSH
T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandbox16.json

Path C:\Users\Admin\AppData\Local\Temp\sandbox16.json
Size 11.7MB
SHA256 61fbc14519c0ada8aeb81b92bb2573ac57dfdd956f88dc4d1fb486a025786980
MD5 bd65369fafb0b4df465e6becffe8d915
SHA1 cc93f4e8c4e7a0a2bd4477ff9cf119f599779105
SHA512 77646380accda7299a20d9db5d4b5350429baeb64c1b74b8c71b6493b7c76ca909b4258c7026bc9f4e7e33eb88a4c2923c6d506cc77533ffb4a3f7bb2e6454aa
SSDEEP 196608:nHGSv6Xpc6NAgLVzCTx6EMomaaYJaZhLCIKt/LcTrLclAWQEV2jiEmDsqxxdGHPp:mSv6Xq6EMlaqrQL+ElAWQSIYIq/dqB
TLSH
T14EC6331D8ACA5766D4B87CB5E24D0B929CEDF4C2CEB05B31AE68C1D520AF04F25493BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1006165539\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandbox16.json

Path C:\Users\Admin\AppData\Roaming\NVIservice_iot\YCPNRJNJUIY\sandbox16.json
Size 4.7MB
SHA256 431bf199d1b71077278581a453819af78c441c20420fd33ea6e6386bf66c9f60
MD5 b6f2583dfa06c02e3eaa1ad1e1a508d8
SHA1 328d3a644b8793ddc267ee4a12137a534ead3b5f
SHA512 371b770f6019bdd8243dfd2bdcc23c718b0308713b7342cd47eb91ad3a303b7ef3be16a298387569d4097f0086c4f21cc89cd3eb6914b9b98e4edb28bf1a48e5
SSDEEP 98304:hxNYS5a9KuB1zNX/10REQq1F8c+y/qLLgaHY2l9btQR:qGa9KkDX/1lz1iBYUS
TLSH
T12C3623FF9BDA8272E62F07715FC361B7C64EA074C7131781CD05F1836A2BB61A25162A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XRegistry.exe

Path C:\Users\Admin\XRegistry.exe
Size 636KB
SHA256 7783faf41c933a01379be18ac070431c244a95a3bf361897ce471eb4040f63e6
MD5 331bc2bf689bedc4496b06b5d7d47bfa
SHA1 c51dd717b5330b8cd5ea6cc0da8aca60ce985bb9
SHA512 ecb21af850002e17393e9a0b46ac5eeb6e2d4403de406bb9fa243b6375f37a075ff47395211335ec1576ccaf41953972afdabf2803d3d4bca57b86c276a69bb0
SSDEEP 12288:WwvXiMGkWpV1j9hcYtHDlUJNlz9PFu9oT/+2I:WwvizD1fcaDqJP9k9j2I
TLSH
T103D47D0BA3A441F9D0BBE178D9075956F7B6B85603B09B9F23E042672F572A09F7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-29-0x00007FF8B8880000-0x00007FF8B8AE3000-memory.dmp

Download

memory/1188-28-0x0000000073300000-0x0000000073352000-memory.dmp

Download

memory/2692-58-0x0000000074DD0000-0x0000000074E22000-memory.dmp

Download

memory/2692-40-0x0000000074DD0000-0x0000000074E22000-memory.dmp

Download

memory/2692-39-0x0000000074DD0000-0x0000000074E22000-memory.dmp

Download

memory/2692-36-0x00007FF8B8880000-0x00007FF8B8AE3000-memory.dmp

Download

memory/2692-64-0x0000000074DD0000-0x0000000074E22000-memory.dmp

Download

memory/2692-35-0x0000000074DD0000-0x0000000074E22000-memory.dmp

Download

memory/2692-43-0x0000000074DD0000-0x0000000074E22000-memory.dmp

Download

memory/2692-51-0x0000000074DD0000-0x0000000074E22000-memory.dmp

Download

memory/2692-37-0x0000000074DF0000-0x0000000074DF1000-memory.dmp

Download

memory/2876-93-0x00007FF8B8880000-0x00007FF8B8AE3000-memory.dmp

Download

memory/3056-108-0x0000000000320000-0x0000000000988000-memory.dmp

Download

memory/3056-96-0x0000000074DD0000-0x0000000074E22000-memory.dmp

Download

memory/3056-76-0x0000000074DD0000-0x0000000074E22000-memory.dmp

Download

memory/3056-73-0x0000000074DD0000-0x0000000074E22000-memory.dmp

Download

memory/3056-74-0x00007FF8B8880000-0x00007FF8B8AE3000-memory.dmp

Download

memory/4448-121-0x0000000074DD0000-0x0000000074E22000-memory.dmp

Download

memory/4448-115-0x00007FF8B8880000-0x00007FF8B8AE3000-memory.dmp

Download

memory/5532-746-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-103-0x00007FF8B8880000-0x00007FF8B8AE3000-memory.dmp

Download

memory/5532-684-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-176-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-704-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-714-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-98-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-122-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-601-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-632-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-320-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-749-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-748-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-783-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-764-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-105-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-757-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5532-774-0x0000000000200000-0x0000000000589000-memory.dmp

Download

memory/5696-104-0x00007FF78F550000-0x00007FF78F7B9000-memory.dmp

Download

memory/5696-109-0x00007FF78F550000-0x00007FF78F7B9000-memory.dmp

Download

memory/5696-86-0x00007FF78F550000-0x00007FF78F7B9000-memory.dmp

Download