hijackloader | 74a1e4dead91d597b2474e157272794d0c43c877d79565b3ce306331f0bfe8b0

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 12.7MB
Sample260820-xaq95atcle
SHA256 74a1e4dead91d597b2474e157272794d0c43c877d79565b3ce306331f0bfe8b0
MD5 bc1ca24e94b383cc9d341e4e3e88bae3
SHA1 3af49cdb64729c8be2d1ac10aa7106f0492e20d6
SHA512 48f6bb762da740621381b261b6741856b8ad39058b65f0b902b8bb2abff769c0310c12e02674dcfc747751a80364964fa0dd6a7062896dc702dc3e93594dbc16
SSDEEP 393216:+pwU9vgFyZtgHKGy96ys1Jf/3HviCHDn1ASXMyq/s:ewuIgwq4J3/iCHRAgtq/s
TLSH
T1A5D63360739578F8C322903AEF0DE35966F6E3A02B014E9A3BCF1D265E571B1494F4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

e4d12643d44b0f664cb095b3db1c2aa6 credential_access discovery hijackloader vidar loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\NVIservice_iot
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

vidar

Version

Botnet

e4d12643d44b0f664cb095b3db1c2aa6

https://62.238.46.160
https://telegram.me/m1duus
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=YmbK
https://steamcommunity.com/profiles/76561198657426610

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c43b-27.dat	family_hijackloader
behavioral2/files/0x000d00000001c451-71.dat	family_hijackloader

Executes dropped EXE 3 IoCs

pid	Process
1968	Runner_Cor.exe
5288	Runner_Cor.exe
4268	Runner_Cor.exe

Loads dropped DLL 10 IoCs

pid	Process
1968	Runner_Cor.exe
1968	Runner_Cor.exe
5288	Runner_Cor.exe
5288	Runner_Cor.exe
4268	Runner_Cor.exe
4268	Runner_Cor.exe
4448	XRegistry.exe
5384	memu.exe
2692	OrbitR.exe
1680	memu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini	OrbitR.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4448	XRegistry.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 5288 set thread context of 4448	5288	Runner_Cor.exe	96
PID 5288 set thread context of 5384	5288	Runner_Cor.exe	97
PID 4268 set thread context of 2692	4268	Runner_Cor.exe	98
PID 4268 set thread context of 1680	4268	Runner_Cor.exe	99
PID 2692 set thread context of 5372	2692	OrbitR.exe	104
PID 2692 set thread context of 476	2692	OrbitR.exe	127
PID 2692 set thread context of 5372	2692	OrbitR.exe	104

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	OrbitR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	OrbitR.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\corerunner.job	memu.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5816	5288	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrbitR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_Cor.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3296	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317248923675995"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2692	OrbitR.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1968	Runner_Cor.exe
5288	Runner_Cor.exe
5288	Runner_Cor.exe
5288	Runner_Cor.exe
5288	Runner_Cor.exe
4268	Runner_Cor.exe
4268	Runner_Cor.exe
4268	Runner_Cor.exe
4268	Runner_Cor.exe
4448	XRegistry.exe
4448	XRegistry.exe
4448	XRegistry.exe
4448	XRegistry.exe
4448	XRegistry.exe
4448	XRegistry.exe
5384	memu.exe
5384	memu.exe
5384	memu.exe
5384	memu.exe
5384	memu.exe
5384	memu.exe
5384	memu.exe
5384	memu.exe
1680	memu.exe
1680	memu.exe
1680	memu.exe
1680	memu.exe
1680	memu.exe
1680	memu.exe
1680	memu.exe
1680	memu.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
5372	chrome.exe
5372	chrome.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe
2692	OrbitR.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	OrbitR.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
5288	Runner_Cor.exe
5288	Runner_Cor.exe
4268	Runner_Cor.exe
4268	Runner_Cor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeDebugPrivilege	2692	OrbitR.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe
Token: SeShutdownPrivilege	5372	chrome.exe
Token: SeCreatePagefilePrivilege	5372	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe
5372	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1968	4908	Setup.exe	89
PID 1968 wrote to memory of 5288	1968	Runner_Cor.exe	90
PID 5288 wrote to memory of 4268	5288	Runner_Cor.exe	91
PID 5288 wrote to memory of 4448	5288	Runner_Cor.exe	96
PID 5288 wrote to memory of 4448	5288	Runner_Cor.exe	96
PID 5288 wrote to memory of 5384	5288	Runner_Cor.exe	97
PID 5288 wrote to memory of 5384	5288	Runner_Cor.exe	97
PID 4268 wrote to memory of 2692	4268	Runner_Cor.exe	98
PID 4268 wrote to memory of 2692	4268	Runner_Cor.exe	98
PID 4268 wrote to memory of 1680	4268	Runner_Cor.exe	99
PID 4268 wrote to memory of 1680	4268	Runner_Cor.exe	99
PID 5372 wrote to memory of 2340	5372	chrome.exe	105
PID 5372 wrote to memory of 1308	5372	chrome.exe	106
PID 5372 wrote to memory of 1308	5372	chrome.exe	106
PID 5372 wrote to memory of 3296	5372	chrome.exe	107
PID 5372 wrote to memory of 1784	5372	chrome.exe	110
PID 5372 wrote to memory of 3056	5372	chrome.exe	111
PID 5372 wrote to memory of 1784	5372	chrome.exe	110
PID 5372 wrote to memory of 3056	5372	chrome.exe	111
PID 5372 wrote to memory of 4256	5372	chrome.exe	109
PID 5372 wrote to memory of 4256	5372	chrome.exe	109
PID 5372 wrote to memory of 1532	5372	chrome.exe	112
PID 5372 wrote to memory of 1532	5372	chrome.exe	112
PID 5372 wrote to memory of 6120	5372	chrome.exe	113
PID 5372 wrote to memory of 6120	5372	chrome.exe	113
PID 5372 wrote to memory of 2840	5372	chrome.exe	114
PID 2692 wrote to memory of 5372	2692	OrbitR.exe	104
PID 2692 wrote to memory of 5372	2692	OrbitR.exe	104
PID 2692 wrote to memory of 5372	2692	OrbitR.exe	104
PID 2692 wrote to memory of 5372	2692	OrbitR.exe	104
PID 2692 wrote to memory of 5372	2692	OrbitR.exe	104
PID 5372 wrote to memory of 1420	5372	chrome.exe	116
PID 5372 wrote to memory of 1420	5372	chrome.exe	116
PID 5372 wrote to memory of 5500	5372	chrome.exe	117
PID 5372 wrote to memory of 5500	5372	chrome.exe	117
PID 5372 wrote to memory of 4496	5372	chrome.exe	122
PID 5372 wrote to memory of 1688	5372	chrome.exe	121
PID 5372 wrote to memory of 4496	5372	chrome.exe	122
PID 5372 wrote to memory of 1688	5372	chrome.exe	121
PID 5372 wrote to memory of 4748	5372	chrome.exe	123
PID 5372 wrote to memory of 5792	5372	chrome.exe	124
PID 5372 wrote to memory of 5792	5372	chrome.exe	124
PID 5372 wrote to memory of 4748	5372	chrome.exe	123
PID 5372 wrote to memory of 5976	5372	chrome.exe	125
PID 5372 wrote to memory of 5716	5372	chrome.exe	126
PID 5372 wrote to memory of 5976	5372	chrome.exe	125
PID 5372 wrote to memory of 5716	5372	chrome.exe	126
PID 2692 wrote to memory of 476	2692	OrbitR.exe	127
PID 2692 wrote to memory of 476	2692	OrbitR.exe	127
PID 2692 wrote to memory of 476	2692	OrbitR.exe	127
PID 2692 wrote to memory of 476	2692	OrbitR.exe	127
PID 2692 wrote to memory of 476	2692	OrbitR.exe	127
PID 2692 wrote to memory of 476	2692	OrbitR.exe	127
PID 5372 wrote to memory of 2656	5372	chrome.exe	129
PID 5372 wrote to memory of 2656	5372	chrome.exe	129
PID 5372 wrote to memory of 1900	5372	chrome.exe	130
PID 5372 wrote to memory of 1900	5372	chrome.exe	130
PID 5372 wrote to memory of 2468	5372	chrome.exe	131
PID 5372 wrote to memory of 2468	5372	chrome.exe	131
PID 5372 wrote to memory of 6132	5372	chrome.exe	132
PID 5372 wrote to memory of 5308	5372	chrome.exe	133
PID 5372 wrote to memory of 6132	5372	chrome.exe	132
PID 5372 wrote to memory of 5308	5372	chrome.exe	133
PID 2692 wrote to memory of 5372	2692	OrbitR.exe	104

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe
  "C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\ProgramData\NVIservice_iot\Runner_Cor.exe
    C:\ProgramData\NVIservice_iot\Runner_Cor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:5288
  - - C:\Users\Admin\AppData\Roaming\NVIservice_iot\EHAZOZRSQMVKGBWLF\Runner_Cor.exe
      C:\Users\Admin\AppData\Roaming\NVIservice_iot\EHAZOZRSQMVKGBWLF\Runner_Cor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\Users\Admin\AppData\Local\OrbitR.exe
        
        C:\Users\Admin\AppData\Local\OrbitR.exe
        5⤵
        Loads dropped DLL
        Drops desktop.ini file(s)
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2692
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:476
    - - C:\Users\Admin\AppData\Roaming\defender_kernel\memu.exe
        
        C:\Users\Admin\AppData\Roaming\defender_kernel\memu.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 636
      4⤵
      Program crash
      PID:5816
  - - C:\Users\Admin\XRegistry.exe
      C:\Users\Admin\XRegistry.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:4448
  - - C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
      C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5288 -ip 5288
1⤵
PID:5456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:4868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xf0,0x134,0x7ff8129bc728,0x7ff8129bc734,0x7ff8129bc740
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,4537438361939255839,14797212246732041698,262144 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,9260509725840970787,13882865906468348861,524288 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,14621459824657828786,15035297732981135771,524288 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:13
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,271283730255773640,15734121216262886761,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,2725724533348828995,10386394096289811342,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4704,i,14597278009777451272,10292347008918972879,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,2914216877745620693,12621107553723611261,524288 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,12194139163365723650,11469882681595906978,524288 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5488,i,14128808273354417325,608590122957086271,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,2253927107075156460,2968391320281733013,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5692,i,13053496058092316596,10798384070873433453,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5520,i,9483926434975057497,6944791927752180570,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6172,i,13672585179432436680,3762680997401122275,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5760,i,9445107774908775973,13927562923860046872,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5772,i,16058308602666426996,1336581384284022195,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5396,i,2272690411221432632,3199940195603220157,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,2070653983317223102,2187258086304778333,524288 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,8232342760964621421,17527679436423045071,524288 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,5112135053911024195,12592212526100621780,524288 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4716,i,11280379174429187911,432235269535052344,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:9
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4820,i,485262526347614948,1408236566211977140,2097152 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,7336247656814409761,14264935538781824879,524288 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6476,i,8422684518881772698,17140553517187236225,524288 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6480,i,10754062403820398815,7797061481276591179,524288 --field-trial-handle=1904,i,2970860158703207919,10445661432126259854,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:5708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6da13c187ad3920b4881568e18af187fc5c0c84adaa006dc258d349554bb37f5
MD5 8584bfd713e68006d289f1ca50febb35
SHA1 d9c0813ecda39a48a84bc36a26ffb3a151835794
SHA512 c0272f55d050ad508e4cf7d6f7293e3f4679b1b1618b0f50c6ce8720c99f0897fdf09e4c3e5e0f17eb60799e130d26cbb7850a3175d3d9be6e1ba7475229ff21
TLSH
T169E02BD5CD21EC270CFD2768A0101646EB4123472781861F3A3D51088FB2736419AC6C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 44KB
SHA256 63afaa6153f02dc3d1a641e41b2a1de10a5f165905ac7cd12acb70ab8b9b2b67
MD5 7db1069d870fb0c40e9512d99f301b8c
SHA1 9c7d7e9432f6a1aa77f1aed03bcab5282215ceb0
SHA512 1c42854655405b7bffdb02ada2279ebc31fccdb109e19a9e74a55e68265c83990d821df3ee348ad8b7a8c7bfe8747e761671aa769b9395a8c3f27d156c178850
SSDEEP 96:Q4HCEmrm43b/LuaLNW9WjWbflE2xFsw2ioNfn:XMW9WqbfhG
TLSH
T1B313224F8E2C3D61D2CA823689C14AD70F39839C96DB5FA459B824214D9174784FB1EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 e61d15a59b2845650434948eb2a0397081cdf956fe91868184233640d9178f05
MD5 94010e7906be33450f2f1ec21da23e9c
SHA1 30874bd6ba1f99935407c0c5a090b680cab79db8
SHA512 bd11f2e9db4e4e070cbc3f83e1992d26cce8366bce17392644b0dd5e88ea1146f6b23183c06d164e862a34a537525ed88ae7fc5a64a5dd10667602cbc19824ba
TLSH
T149E08694388DC16E9455D46397AE771CCED13908A7C9FD02170AEC98219190875D6350
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c2a7bfea157592fe4f2c51c509c7300ea117ce40cfbb35b3c27d7e15f6459b1c
MD5 bd750b10c26d2c44d8ace2ec6e1838dc
SHA1 66b38d2aea6c37da37728464f8fe82954a0de3d6
SHA512 9226c0d03a8f20b8d17960465ecb97262b754e95429e2a5264ca529c8713614c30466a18bdc5ec1a860b58195a2092e6a07d3b5363954f546e98197b6578b8c9
SSDEEP 192:+RQDAQVv7JQAPRp2799Hsb+WNnhh0Mjw28M4x88lVyIsnAUgR:+RQDflPXcvwH0p294xFR
TLSH
T1E432A62EAE10293B5CDBD229FD227763E7F5102675D42E84EAFC992C15E7ACC2127007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 54b0eea83d0e1a051b4f007a55427a1fed53e624e53da6a57c90836075dd8938
MD5 6560bcac7a7f731129acf32fe41d855d
SHA1 9d1985c5bc722cb20a3b650fcd14a3bf5a1fc2ee
SHA512 cea92d14cd933545a134829c02a2e092324d913b375cf11c0a2794447929eb8028c5fc6b6afb6699435fb0bace921eb275b7818e32d6c9823c0e30ecbb5072a0
SSDEEP 192:e/Q4K6I+7KxkXqK4I40pUZNCgVLHrKHfFKslE8nRXzKD/KB+ErUkKN9MFUxpElbC:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRu
TLSH
T1DF32C72BA48D9A3F4FA8D50DDC126F4BACA5025776780C2456FB9D0803A5BCE115A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f013561d093673221f724e9b54386d2fce3896f2f9099284d4c218153a91de23
MD5 c40aa6a9d87f768c2e14b6648c26ee75
SHA1 aec4973b577a4fc7a642d57d368b4de11b85514a
SHA512 a38f11f1f94cf409fc412261794651563a2b8dda75dd83561369a17a18677625ed3441b34648264f2c71676a46dd2c855a2045b3d29f8b8c1dfa06c1fd69e1ed
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok5l4DhB6vGyvk54EUTboRYv4a:5C0Ngjf5ZKSNqDUD8X7qEUTbog
TLSH
T13DA11AB1A46D4DB394B6C589B1437B43DEA421ABA561FF80E8DC1F0C00FB5E81382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 540ca6a36230248dd25aa4a8bf023770245e06a2cf01f73f51e5f750cc67bcb7
MD5 8447329eaf9e2ae55314e5a8a7c3850c
SHA1 55d5c36ff1af54ab96eb9936799ee9fb90d1f524
SHA512 fa44c5e3cb43ea6d23ab15f37187925b88de37897b9f9e08065d423e10695637716b843fde8230500b91d4211a56425fb3a462e53d47b360a610866b20f101dd
SSDEEP 3072:OoXymQ4GL9hAq6gWTgD9gco4fQJPK3KXk/jz:Oo12X6gTgcJIo6Xkf
TLSH
T129D3123018740F17A6C9DA03E527AFFEC8B4CB7B9604F728176BBB99125F2E44205976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OrbitR.exe

Path C:\Users\Admin\AppData\Local\OrbitR.exe
Size 1.1MB
SHA256 d7e56ec27a3f8ab8c6b81cb146ac41c1e14ef8317dc8680610a9cc906e49d7b2
MD5 6bc2b98cad631e321727a8a0e049498a
SHA1 9758e82fe36d55df726d4afa0e55989ec2a515d0
SHA512 e3bbf585d3d4b26439b9a4572d3f17d1ff756800b3376f64b208d8dfb7b994866197767bfa1587e31a78a4ed8339849e8e62eea492eef439d85212913fe4301c
SSDEEP 12288:UcP8/ti/Kc9L6/Wm/GMKBJK68xHyeQUur/RYiG7jP1Vt9NOSblN+R/2krPjqn6FF:U48F0vL6umGLHgd9EwNIO8+6FSkqq3
TLSH
T133358D607B49D63AEA920173CA7DAB5F211DF5620B2915C3F2CC0AAC5D706D36E3A707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

107A243.tmp

Path C:\Users\Admin\AppData\Local\Temp\107A243.tmp
Size 40B
SHA256 a9999e8a03f9b52d4a35e5da22296fde05332bd4e0386a813c28ced52c197e1b
MD5 89d18d28e274049622664876e1b845a0
SHA1 79285e0d8775cd5930f47c3459574569e4e37e58
SHA512 e8ab57c09049308fc02f5218185ce0b17f46eaabbd537607a3adaa485982e6959753c9ed9d4782a772c4145192091011f1e9620fd1363d9d022a5f6d38bfaaac
MD5 SHA1 SHA512

Submit Download

2AB9939.tmp

Path C:\Users\Admin\AppData\Local\Temp\2AB9939.tmp
Size 5.4MB
SHA256 7c59e92d6fb674d37af6cc43fddde52d302ef537ca72b4f85ad9a9e6885629eb
MD5 a82d8862959182df6d9eca4cd766d49b
SHA1 1eb5fc9e4133bf848d9742ab801eafbc0834baee
SHA512 a07f49cd0e3c8cfd0a90bffae8783accce03aabc8b41823c6383f0c3b2712966e252c52ab2d5b3d37c31d3b60f84956cf924aa5927cd44d92306058faf0991ad
SSDEEP 98304:VLfONoXV2yKpM0h7cklk+Elvh+BRcNaSPOjW5h9u:VLfONUVshrlByfbPsWlu
TLSH
T1BD463350B1EB371ABB5F15F8B971C6DCF4C68488434A5F642B1F72082FC6268AD359C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2AB9939.tmp

Path C:\Users\Admin\AppData\Local\Temp\2AB9939.tmp
Size 5.4MB
SHA256 7fb10b3e759d1dbf1f2c989c2627f67684a271034bb78c8c9316dac4f44c0b7a
MD5 0aa9f7829db45e3c24bc0bbc10db45f6
SHA1 752042c2a9310cb9097fec8e00a5d72af9575f9d
SHA512 ab583a7aadc86caaafe31d030023d5235ffd330bd957a09f5168c2a28cf2c52b07881819197b6084310ac267098d8d359ed540f57a47c0573e6fd82ec3c16d78
SSDEEP 98304:DLSONoXV2yKpM0h7cklk+Elvh+BRcNaSPOjW5h9u:DLSONUVshrlByfbPsWlu
TLSH
T13F463350B1EB371ABB5F15F8B971C6DCF4C68488434A5F642B1F72082FC6268AD359C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

424C2EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\424C2EB.tmp
Size 40B
SHA256 5ff7e21729053db4d0ed832405f9c7f8764088a2ba020e1ac1b4c36f7cbbf29b
MD5 88f3aa61f3f507f98ae7bf854fec37e4
SHA1 020d8e08436e5637764a673fa2c101fc38a3f6a3
SHA512 f9c031c8d3c16df2b37128d8a1781578d527dcc77a498fc9d09342f2af79eba96848f679c59f7e32980410a9e2acbf62f55321bb20f88e073004011f65153d69
MD5 SHA1 SHA512

Submit Download

B1263C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\B1263C1.tmp
Size 15.6MB
SHA256 df297d0df18b4bd8ab0724fad95cb3aba6d07ff1ba10dce3aeac3cf3cb0ee43b
MD5 cc45e4da77bc16fdf794130f5efb1563
SHA1 054fd08b00f20ea51fb09ce14d0724e867627f7c
SHA512 f637802af886ff67773fbcce7a9214e42e072973a17ce4401112a5cfc6cff46d5dcc8a24bd061596aea1a5da3952cb28fa21c468342e8166f1ada2b18829283c
SSDEEP 393216:3LvCbwsw9ZycZ8rdvzjmlSOrV3gqQSJPRZmA+tj02:3jCMT9ZycmdvzSnJPRs
TLSH
T1FBF633ECE4B8C6E6D04BE4A9976017BA8D0E25716EBD79DBC7CB7C73D20051268189C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B1263C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\B1263C1.tmp
Size 15.6MB
SHA256 3c7d36a682caa589d2e328cd33936530f8176da4a80bad0f3ead7a5b56bb835e
MD5 a3654773192ae628efc95c47da0ac23b
SHA1 10abd357462c05bce4f47f1867bb8ef20a77260a
SHA512 0a6fdd14228aac830c9bc8b440d5c20cfeddb576ec5c9f030cd5d54427f31f2ab9390fa3782af83d2d6e2572fb28893828779ddc266c43cdc676a455bac25657
SSDEEP 393216:RLUCbwsw9ZycZ8rdvzjmlSOrV3gqQSJPRZmA+tj02:RwCMT9ZycmdvzSnJPRs
TLSH
T140F633ECE4B8C6E6D04BE4A9976017BA8D0E25716EBD79DBC7CB7C73D20051268189C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebuggerProxy.dll

Path C:\Users\Admin\AppData\Local\Temp\DebuggerProxy.dll
Size 358KB
SHA256 2760521e67d374303447a6d75bf6da7aad6fd0057aed526b163d241ea98acd17
MD5 b2b975f47e8fa68bf5cf4b452b78fcd8
SHA1 3125be67c772dcad88a076f0f0196bd8d440e379
SHA512 f0b64e78c05e4fbbd1ec7fc28c011c531766d28a4a3f469ba51f92600b3db29284a922efeaaad265126cb4c8e41ef43132bee66f337361f80965f50677a0b949
SSDEEP 3072:RyGPDDc3I6S8YtqKOZBeHAUWbvm8/1wRPF2qGatRToxr1M2tbWRLRXMj+VqKzzIO:XcBCmcHbKqGOWr1M2KMjy
TLSH
T1DD74E853F7648438C5AE64369466E334A3682E18B3D076DB9A807794B8B3581EF33FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Runner_Cor.exe

Path C:\Users\Admin\AppData\Local\Temp\Runner_Cor.exe
Size 6.0MB
SHA256 e4547515dfa570f2f3450fd83249db59896b0a7896110f2c8897fb3fc9eb9e6e
MD5 d76c8443fc58215fbee97905c056e421
SHA1 8900008928d313cfb472c0a9abb104be3e0db4d8
SHA512 7d04c2b0dc13a22bf1fa6a329842e7ce2afc41c1ff37540d93600d8540f3fb2bf83558b8945da4f8e67c779c31b4d5e80f38c488079fa6d9d7e580ad617cbd0b
SSDEEP 98304:ERAVV/Zj6Uui3jg/MxS/2dStFQ4ldOAQ5i7JSToVE/5l7LBi:GAxj6Uuas/Mxw2gtFQ4ld1rpkz8
TLSH
T117569E21B910C171E6D10132EABD6BBB546C96311B2C10DBE3E45A3AAD705D36F32F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filter_spec.meta

Path C:\Users\Admin\AppData\Local\Temp\filter_spec.meta
Size 26KB
SHA256 54cdf3af232a79976749a7f945b07d45b69bbc69f5efa3c9f30b9ac1149df8fd
MD5 19bd0258d73e7f1795208ee9e1af564a
SHA1 65e8914e54e3cce98b39c84aea29292b1a463fd3
SHA512 dd9674c02ddea8e921869a800c131da6bbcbeb620330d0a99fd1e5ea1d7ead283caea3d7f107403f3d4bebf771e2763ad03b9fe3cb47100a0319db1c58ff0410
SSDEEP 768:n7AD7GCjxI6lOOWhEHagrvVtfNG/ZW+13Og3dR:n8bjxInhE6gQZWy3OqdR
TLSH
T149C29E7E865F8F94A14F983DEC24E0D3C254F1B93D0E256261DA08ABB816DEDC124CA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mss32.dll

Path C:\Users\Admin\AppData\Local\Temp\mss32.dll
Size 345KB
SHA256 bddb62373f616bf8edd6cfe580d80b2fd0325069f59fbc2b70b2cb0458241926
MD5 ef698a81b3db0654e4ee65a8deaa8a59
SHA1 764826c1b2612ce1ea0b904af63cd1faeb41c87b
SHA512 a96e683d3d3c50dad4d7706a7a7b8a05a6a7ed304971a2cada137a573464396d04675733692aa1d4594cd7ca25e78eaf1e9d26f75c24f4e55053b49c9fdd2695
SSDEEP 6144:spcTapyHuUcl0PUpFawtMR6gP4aHrmtcER3uAy:EIaQ+l0PoVtW6aHrmtcERty
TLSH
T13B745C20764002B6C4E1387BE83E3B39A4BD9F696686116B3545CCAD1E73DE0B74F61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 485KB
SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
TLSH
T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandbox16.json

Path C:\Users\Admin\AppData\Local\Temp\sandbox16.json
Size 11.7MB
SHA256 61fbc14519c0ada8aeb81b92bb2573ac57dfdd956f88dc4d1fb486a025786980
MD5 bd65369fafb0b4df465e6becffe8d915
SHA1 cc93f4e8c4e7a0a2bd4477ff9cf119f599779105
SHA512 77646380accda7299a20d9db5d4b5350429baeb64c1b74b8c71b6493b7c76ca909b4258c7026bc9f4e7e33eb88a4c2923c6d506cc77533ffb4a3f7bb2e6454aa
SSDEEP 196608:nHGSv6Xpc6NAgLVzCTx6EMomaaYJaZhLCIKt/LcTrLclAWQEV2jiEmDsqxxdGHPp:mSv6Xq6EMlaqrQL+ElAWQSIYIq/dqB
TLSH
T14EC6331D8ACA5766D4B87CB5E24D0B929CEDF4C2CEB05B31AE68C1D520AF04F25493BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5372_727795507\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandbox16.json

Path C:\Users\Admin\AppData\Roaming\NVIservice_iot\EHAZOZRSQMVKGBWLF\sandbox16.json
Size 4.7MB
SHA256 431bf199d1b71077278581a453819af78c441c20420fd33ea6e6386bf66c9f60
MD5 b6f2583dfa06c02e3eaa1ad1e1a508d8
SHA1 328d3a644b8793ddc267ee4a12137a534ead3b5f
SHA512 371b770f6019bdd8243dfd2bdcc23c718b0308713b7342cd47eb91ad3a303b7ef3be16a298387569d4097f0086c4f21cc89cd3eb6914b9b98e4edb28bf1a48e5
SSDEEP 98304:hxNYS5a9KuB1zNX/10REQq1F8c+y/qLLgaHY2l9btQR:qGa9KkDX/1lz1iBYUS
TLSH
T12C3623FF9BDA8272E62F07715FC361B7C64EA074C7131781CD05F1836A2BB61A25162A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\NVIservice_iot\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XRegistry.exe

Path C:\Users\Admin\XRegistry.exe
Size 636KB
SHA256 7783faf41c933a01379be18ac070431c244a95a3bf361897ce471eb4040f63e6
MD5 331bc2bf689bedc4496b06b5d7d47bfa
SHA1 c51dd717b5330b8cd5ea6cc0da8aca60ce985bb9
SHA512 ecb21af850002e17393e9a0b46ac5eeb6e2d4403de406bb9fa243b6375f37a075ff47395211335ec1576ccaf41953972afdabf2803d3d4bca57b86c276a69bb0
SSDEEP 12288:WwvXiMGkWpV1j9hcYtHDlUJNlz9PFu9oT/+2I:WwvizD1fcaDqJP9k9j2I
TLSH
T103D47D0BA3A441F9D0BBE178D9075956F7B6B85603B09B9F23E042672F572A09F7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1680-119-0x00007FF837C60000-0x00007FF837EC3000-memory.dmp

Download

memory/1680-123-0x00000000754D0000-0x0000000075522000-memory.dmp

Download

memory/1968-29-0x00007FF837C60000-0x00007FF837EC3000-memory.dmp

Download

memory/1968-28-0x0000000073A00000-0x0000000073A52000-memory.dmp

Download

memory/2692-104-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/2692-337-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/2692-126-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/2692-127-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/2692-130-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/2692-101-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/2692-110-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/2692-607-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/2692-109-0x00007FF837C60000-0x00007FF837EC3000-memory.dmp

Download

memory/2692-184-0x0000000001100000-0x0000000001489000-memory.dmp

Download

memory/4268-75-0x00000000754D0000-0x0000000075522000-memory.dmp

Download

memory/4268-72-0x00000000754D0000-0x0000000075522000-memory.dmp

Download

memory/4268-99-0x00000000754D0000-0x0000000075522000-memory.dmp

Download

memory/4268-113-0x00000000009B0000-0x0000000001018000-memory.dmp

Download

memory/4268-73-0x00007FF837C60000-0x00007FF837EC3000-memory.dmp

Download

memory/4448-88-0x00007FF6E68E0000-0x00007FF6E6B49000-memory.dmp

Download

memory/4448-97-0x00007FF6E68E0000-0x00007FF6E6B49000-memory.dmp

Download

memory/4448-102-0x00007FF6E68E0000-0x00007FF6E6B49000-memory.dmp

Download

memory/5288-65-0x00000000754D0000-0x0000000075522000-memory.dmp

Download

memory/5288-35-0x00000000754D0000-0x0000000075522000-memory.dmp

Download

memory/5288-36-0x00007FF837C60000-0x00007FF837EC3000-memory.dmp

Download

memory/5288-38-0x00000000754D0000-0x0000000075522000-memory.dmp

Download

memory/5288-40-0x00000000754D0000-0x0000000075522000-memory.dmp

Download

memory/5288-37-0x00000000754F0000-0x00000000754F1000-memory.dmp

Download

memory/5288-41-0x00000000754D0000-0x0000000075522000-memory.dmp

Download

memory/5288-47-0x00000000754D0000-0x0000000075522000-memory.dmp

Download

memory/5288-51-0x00000000754D0000-0x0000000075522000-memory.dmp

Download

memory/5288-63-0x00000000754D0000-0x0000000075522000-memory.dmp

Download

memory/5288-66-0x00000000754F0000-0x00000000754F1000-memory.dmp

Download

memory/5384-95-0x00007FF837C60000-0x00007FF837EC3000-memory.dmp

Download