hijackloader | f3d69fda955e715bb7ebc418db1e8a21bc5a8e05f38beb879c55087c7e21efb2

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UTODYIBG.msi
Size 8.7MB
Sample260820-xyftasxtcv
SHA256 f3d69fda955e715bb7ebc418db1e8a21bc5a8e05f38beb879c55087c7e21efb2
MD5 b86bb00857035f4dec9518de7623bc4d
SHA1 e3af411d17987883fb4458f6c1ac372606b7adf0
SHA512 1d1618154c8e5442816b81d7e3bb9ecaafeb565b82e424dadbc226772c3b85610fe4a188a78c07c0b56571ff91fe35f15a4bd0f9bcbc6c9162ea40763d272e1c
SSDEEP 196608:z6nI46JZk2z8mCPrNhvAXosm1RaxUHAoAOKDFOj79OW:z6p6J22z8mAHa412OAVF8O
TLSH
T11A96331D36990B3DCF167DBA54279B00816E2CFC368A877A2E54F2D3B433905799A372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\GynexEndpoint
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4ba-55.dat	family_hijackloader

Executes dropped EXE 8 IoCs

pid	Process
5996	Clus_Lab16.exe
2816	Clus_Lab16.exe
3840	Boost Note.exe
4292	Boost Note.exe
5780	Boost Note.exe
5808	Boost Note.exe
5260	Boost Note.exe
1416	Boost Note.exe

Loads dropped DLL 33 IoCs

pid	Process
5996	Clus_Lab16.exe
5996	Clus_Lab16.exe
5996	Clus_Lab16.exe
5996	Clus_Lab16.exe
5996	Clus_Lab16.exe
5996	Clus_Lab16.exe
5996	Clus_Lab16.exe
5996	Clus_Lab16.exe
5996	Clus_Lab16.exe
5996	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
3840	Boost Note.exe
4292	Boost Note.exe
4292	Boost Note.exe
4292	Boost Note.exe
4292	Boost Note.exe
5780	Boost Note.exe
5808	Boost Note.exe
5260	Boost Note.exe
5260	Boost Note.exe
5260	Boost Note.exe
5260	Boost Note.exe
1416	Boost Note.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\2dRhfF\\Boost Note.exe"	Boost Note.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\2dRhfF\\Boost Note.exe"	Boost Note.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2816 set thread context of 3404	2816	Clus_Lab16.exe	104
PID 2816 set thread context of 6236	2816	Clus_Lab16.exe	129
PID 2816 set thread context of 3404	2816	Clus_Lab16.exe	104
PID 2816 set thread context of 6464	2816	Clus_Lab16.exe	148

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	Clus_Lab16.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	Clus_Lab16.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF815F8B37B7BD5BF3.TMP	msiexec.exe
File created	C:\Windows\Installer\e59d72c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6582EA91FED2D99E.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5BBFA93C-8E87-484E-B6C5-904799E842B7}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7330E38C7B99524E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD47.tmp	msiexec.exe
File created	C:\Windows\Tasks\QaidorisSoftware.job	Clus_Lab16.exe
File opened for modification	C:\Windows\Installer\e59d72c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e59d72e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1D9F1E2C840B04C8.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2484	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clus_Lab16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clus_Lab16.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5264	chrome.exe
2088	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317270146516384"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2816	Clus_Lab16.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1684	msiexec.exe
1684	msiexec.exe
5996	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
3404	chrome.exe
3404	chrome.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
5780	Boost Note.exe
5780	Boost Note.exe
1416	Boost Note.exe
1416	Boost Note.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
2816	Clus_Lab16.exe
3404	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2816	Clus_Lab16.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2484	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2484	msiexec.exe
Token: SeSecurityPrivilege	1684	msiexec.exe
Token: SeCreateTokenPrivilege	2484	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2484	msiexec.exe
Token: SeLockMemoryPrivilege	2484	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2484	msiexec.exe
Token: SeMachineAccountPrivilege	2484	msiexec.exe
Token: SeTcbPrivilege	2484	msiexec.exe
Token: SeSecurityPrivilege	2484	msiexec.exe
Token: SeTakeOwnershipPrivilege	2484	msiexec.exe
Token: SeLoadDriverPrivilege	2484	msiexec.exe
Token: SeSystemProfilePrivilege	2484	msiexec.exe
Token: SeSystemtimePrivilege	2484	msiexec.exe
Token: SeProfSingleProcessPrivilege	2484	msiexec.exe
Token: SeIncBasePriorityPrivilege	2484	msiexec.exe
Token: SeCreatePagefilePrivilege	2484	msiexec.exe
Token: SeCreatePermanentPrivilege	2484	msiexec.exe
Token: SeBackupPrivilege	2484	msiexec.exe
Token: SeRestorePrivilege	2484	msiexec.exe
Token: SeShutdownPrivilege	2484	msiexec.exe
Token: SeDebugPrivilege	2484	msiexec.exe
Token: SeAuditPrivilege	2484	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2484	msiexec.exe
Token: SeChangeNotifyPrivilege	2484	msiexec.exe
Token: SeRemoteShutdownPrivilege	2484	msiexec.exe
Token: SeUndockPrivilege	2484	msiexec.exe
Token: SeSyncAgentPrivilege	2484	msiexec.exe
Token: SeEnableDelegationPrivilege	2484	msiexec.exe
Token: SeManageVolumePrivilege	2484	msiexec.exe
Token: SeImpersonatePrivilege	2484	msiexec.exe
Token: SeCreateGlobalPrivilege	2484	msiexec.exe
Token: SeBackupPrivilege	4256	vssvc.exe
Token: SeRestorePrivilege	4256	vssvc.exe
Token: SeAuditPrivilege	4256	vssvc.exe
Token: SeBackupPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2484	msiexec.exe
2484	msiexec.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2484	msiexec.exe
1684	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 3012	1684	msiexec.exe	95
PID 1684 wrote to memory of 5996	1684	msiexec.exe	97
PID 5996 wrote to memory of 2816	5996	Clus_Lab16.exe	98
PID 3404 wrote to memory of 1168	3404	chrome.exe	105
PID 3404 wrote to memory of 2088	3404	chrome.exe	107
PID 3404 wrote to memory of 3476	3404	chrome.exe	108
PID 3404 wrote to memory of 3476	3404	chrome.exe	108
PID 3404 wrote to memory of 2620	3404	chrome.exe	109
PID 3404 wrote to memory of 2620	3404	chrome.exe	109
PID 3404 wrote to memory of 364	3404	chrome.exe	110
PID 3404 wrote to memory of 364	3404	chrome.exe	110
PID 3404 wrote to memory of 3580	3404	chrome.exe	111
PID 3404 wrote to memory of 3580	3404	chrome.exe	111
PID 3404 wrote to memory of 3928	3404	chrome.exe	112
PID 3404 wrote to memory of 3928	3404	chrome.exe	112
PID 3404 wrote to memory of 4320	3404	chrome.exe	113
PID 3404 wrote to memory of 4320	3404	chrome.exe	113
PID 2816 wrote to memory of 3404	2816	Clus_Lab16.exe	104
PID 2816 wrote to memory of 3404	2816	Clus_Lab16.exe	104
PID 2816 wrote to memory of 3404	2816	Clus_Lab16.exe	104
PID 2816 wrote to memory of 3404	2816	Clus_Lab16.exe	104
PID 2816 wrote to memory of 3404	2816	Clus_Lab16.exe	104
PID 3404 wrote to memory of 2452	3404	chrome.exe	114
PID 3404 wrote to memory of 4624	3404	chrome.exe	117
PID 3404 wrote to memory of 5432	3404	chrome.exe	116
PID 3404 wrote to memory of 4624	3404	chrome.exe	117
PID 3404 wrote to memory of 5432	3404	chrome.exe	116
PID 2816 wrote to memory of 3840	2816	Clus_Lab16.exe	119
PID 3840 wrote to memory of 4292	3840	Boost Note.exe	120
PID 3840 wrote to memory of 5780	3840	Boost Note.exe	122
PID 3404 wrote to memory of 5796	3404	chrome.exe	124
PID 3404 wrote to memory of 5796	3404	chrome.exe	124
PID 5808 wrote to memory of 5260	5808	Boost Note.exe	126
PID 5808 wrote to memory of 1416	5808	Boost Note.exe	127
PID 2816 wrote to memory of 6236	2816	Clus_Lab16.exe	129
PID 2816 wrote to memory of 6236	2816	Clus_Lab16.exe	129
PID 2816 wrote to memory of 6236	2816	Clus_Lab16.exe	129
PID 2816 wrote to memory of 6236	2816	Clus_Lab16.exe	129
PID 2816 wrote to memory of 6236	2816	Clus_Lab16.exe	129
PID 2816 wrote to memory of 6236	2816	Clus_Lab16.exe	129
PID 3404 wrote to memory of 6432	3404	chrome.exe	133
PID 3404 wrote to memory of 6612	3404	chrome.exe	134
PID 3404 wrote to memory of 6432	3404	chrome.exe	133
PID 3404 wrote to memory of 6612	3404	chrome.exe	134
PID 3404 wrote to memory of 6620	3404	chrome.exe	135
PID 3404 wrote to memory of 6620	3404	chrome.exe	135
PID 2816 wrote to memory of 3404	2816	Clus_Lab16.exe	104
PID 2816 wrote to memory of 3404	2816	Clus_Lab16.exe	104
PID 2816 wrote to memory of 3404	2816	Clus_Lab16.exe	104
PID 2816 wrote to memory of 3404	2816	Clus_Lab16.exe	104
PID 2816 wrote to memory of 3404	2816	Clus_Lab16.exe	104
PID 3404 wrote to memory of 3096	3404	chrome.exe	138
PID 3404 wrote to memory of 7164	3404	chrome.exe	139
PID 3404 wrote to memory of 6184	3404	chrome.exe	140
PID 3404 wrote to memory of 6172	3404	chrome.exe	141
PID 3404 wrote to memory of 3180	3404	chrome.exe	142
PID 3404 wrote to memory of 3096	3404	chrome.exe	138
PID 3404 wrote to memory of 7164	3404	chrome.exe	139
PID 3404 wrote to memory of 6328	3404	chrome.exe	143
PID 3404 wrote to memory of 6328	3404	chrome.exe	143
PID 3404 wrote to memory of 6732	3404	chrome.exe	144
PID 3404 wrote to memory of 6740	3404	chrome.exe	145
PID 3404 wrote to memory of 6732	3404	chrome.exe	144
PID 3404 wrote to memory of 6740	3404	chrome.exe	145

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\UTODYIBG.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2484

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3012
- C:\Users\Admin\AppData\Local\Snib\Clus_Lab16.exe
  "C:\Users\Admin\AppData\Local\Snib\Clus_Lab16.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\ProgramData\GynexEndpoint\Clus_Lab16.exe
    C:\ProgramData\GynexEndpoint\Clus_Lab16.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Users\Admin\AppData\Local\2dRhfF\Boost Note.exe
      "C:\Users\Admin\AppData\Local\2dRhfF\Boost Note.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3840
    - - C:\Users\Admin\AppData\Local\2dRhfF\Boost Note.exe
        
        "C:\Users\Admin\AppData\Local\2dRhfF\Boost Note.exe" --type=gpu-process --field-trial-handle=1568,16856978769226409641,12195047906017880732,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1576 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\2dRhfF\Boost Note.exe
        
        "C:\Users\Admin\AppData\Local\2dRhfF\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1568,16856978769226409641,12195047906017880732,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1900 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:5780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:6236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:6464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:1016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe4886c728,0x7ffe4886c734,0x7ffe4886c740
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,18000317261053292803,2849583686349309812,524288 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2860,i,15129213284864675148,18409277474047845044,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2892,i,18259457810926084283,17789972463191566643,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2008,i,14248193437822515292,14774976551238964065,524288 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,6642838454026886050,18067473553452699154,262144 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4688,i,4343470070543879774,15384357739223735756,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,9420551051346812273,3288050478561902487,524288 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,895431093713537863,16200953347141852252,524288 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5632,i,13969003374476059283,11023690893623299906,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5660,i,13824034710485373275,15588965423884607589,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5964,i,12056360302961714431,15156630536179520898,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5648,i,4709644152964165940,339043884199961182,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:6432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5640,i,17448717674506416394,5710493832123163580,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:6612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,3325757576979439740,1603540789381479244,524288 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:6620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,16249480298132159126,3252786758039876170,524288 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5808,i,5277974482801768760,12275476603502365229,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:7164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,11534044068436122151,3486300794200244651,524288 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:6184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,15990463155390300072,6173210081642400027,524288 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:6172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,333679471273687410,10778688072781585292,524288 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6244,i,12452473102212808184,14014442146775761293,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:6328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5892,i,5802290963056712140,519602806035028777,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:6732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,13938387158941598970,17801474465649405680,524288 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:6740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5756,i,12956449776913057042,1937554188569605341,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:9
  2⤵
  PID:7112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4696,i,16226790076542019091,2000717005017245939,2097152 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:7160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,11291828733402539478,12450736271806319073,524288 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  PID:6572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1232,i,1765872351454175650,509353054246777260,524288 --field-trial-handle=2292,i,15263128022460961890,3862213643093861283,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5772

C:\Users\Admin\AppData\Local\2dRhfF\Boost Note.exe
"C:\Users\Admin\AppData\Local\2dRhfF\Boost Note.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Users\Admin\AppData\Local\2dRhfF\Boost Note.exe
  "C:\Users\Admin\AppData\Local\2dRhfF\Boost Note.exe" --type=gpu-process --field-trial-handle=1616,13576995175247566830,4319359656299730114,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1620 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5260
- C:\Users\Admin\AppData\Local\2dRhfF\Boost Note.exe
  "C:\Users\Admin\AppData\Local\2dRhfF\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,13576995175247566830,4319359656299730114,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1936 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59d72d.rbs

Path C:\Config.Msi\e59d72d.rbs
Size 10KB
SHA256 a1fb2e17cc7e62738d30f6641beb4cbe3e467080949931e021b0b676f007fd78
MD5 823935f6b4bb26b0d62a3b08e4fef51d
SHA1 6d9f439dbc1caa860f40e50c1f890a5c9a376821
SHA512 cb4a533ed66483855e424302d7f65fec2baa1b55bde0d62a9048d4f6e67a8155e7a695feee767b002b6217361398ca84414eb6e7f941c58359d8e085d24ce016
SSDEEP 96:Jgjfu+Zm0fOspfIHV01Yr/Yv0KYZCf7s717URgjcCsThqSURgjcC6j3q747wYThg:J6Gou+GM2C0oW/IsW/iQ+45TEpS
TLSH
T1762262C1B208D7D6E86623338A272F1C7FF7C7C996A4674B5489D1211F93ED8E989083
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\2dRhfF\D3DCompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\2dRhfF\chrome_100_percent.pak
Size 123KB
SHA256 f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9
MD5 a59ea69d64bf4f748401dc5a46a65854
SHA1 111c4cc792991faf947a33386a5862e3205b0cff
SHA512 12a1d953df00b6464ecc132a6e5b9ec3b301c7b3cefe12cbcad27a496d2d218f89e2087dd01d293d37f29391937fcbad937f7d5cf2a6f303539883e2afe3dacd
SSDEEP 3072:YerKzw9bpxlr+bEfF2DGb0+VvfGGY304F2DExm/KLQ2I:YeKzw9Vh90Gb0OveGe04mExhLY
TLSH
T187C3D0D373F0ED7DCF6756B7A52A41B1ECB302391A92034A469AD8356A27348DDC8393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\2dRhfF\chrome_200_percent.pak
Size 183KB
SHA256 7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b
MD5 1985b8fc603db4d83df72cfaeeac7c50
SHA1 5b02363de1c193827062bfa628261b1ec16bd8cf
SHA512 27e90dd18cbce0e27c70b395895ef60a8d2f2f3c3f2ca38f48b7ecf6b0d5e6fefbe88df7e7c98224222b34ff0fbd60268fdec17440f1055535a79002044c955b
SSDEEP 3072:yDfDQYaEM+9bslr+bEfEfRIGMR+F8fQnYw9pGbXGYoDd+qHqRxmeK/rIM0:6DQYaF+9bMhCWGMRe8InVXYopym74
TLSH
T12E04D1D7A3F49D3CDAB30A77553A01F1ECB6127516A3424A42DBAC347A5678C4CC9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\2dRhfF\ffmpeg.dll
Size 2.7MB
SHA256 8653b57b37618f11e358c93aad9dc9ef0193f0288f7e59147194e42b0842b50e
MD5 b34d74a152e1788532b0acfa8cfbdf1e
SHA1 e99e5a26d8b695b57cb1a1bb0d2c032d822d0461
SHA512 06f8def21101d8c899c321b3a445e6838f824d6d6305d569b49fb7ad14a197a57c601a8965c50057e7af1d5414b74dd2c79e2f27a58eedab31b3b36202947dd9
SSDEEP 49152:nSFoiJBtTcoQ9mjUBA6vXH4VjB0kxryYTK8gJ2EDE+oM0iloSa08UHdiVqAy6cTC:ijUBA656ryEpEdiVq4
TLSH
T1DFD59D0BF2A645DDC029C53083AFA233F934394A4725A6EF16A156252F3FFD0667EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\2dRhfF\icudtl.dat
Size 9.9MB
SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
MD5 70499b58dc18e7ee1d7452a1d7a8bc6e
SHA1 41c5382f08c6a88670ce73a20c0dcdb3822f19e9
SHA512 a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6
SSDEEP 196608:uUGwSv9AAQnt6liXUxR0rHa93WhlU6t7CLhl:uoKlQnAliXUxR0rHa93WhlU6t+Ln
TLSH
T131A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\2dRhfF\locales\en-US.pak
Size 85KB
SHA256 ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b
MD5 6bbeeb72daebc3b0cbd9c39e820c87a9
SHA1 bd9ebec2d3fc03a2b27f128cf2660b33a3344f43
SHA512 66944fb1abcc2a7e08e5fd8a2cee53eb9da57653d7880aea226f25879e26379f7d745ebf62a3518378fa503f3a31b3ea3716f49fe4c7db4f4af0228b81b53a10
SSDEEP 1536:MzBh0wu6Y90fYSKD0R4RlQ2trhWMJ5dBxgMSO0JedMVrBHhQYVfD3ggl+C/fpkwG:6hp1YSwhBxgrvQY3ggl+CGwG
TLSH
T1BB835E1BE3C41266099243227F06E3B6AB26D079936311663C6CC16C3777FA982777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\2dRhfF\resources.pak
Size 4.9MB
SHA256 367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df
MD5 5507bc28022b806ea7a3c3bc65a1c256
SHA1 9f8d3a56fef7374c46cd3557f73855d585692b54
SHA512 ae698d4feacc3e908981ee44df3a9d76e42a39bf083eaf099442ace2b863f882b43232e26e2c18051ca7aec81dccef5742acc7b82fb0cda2e14086b14d5a9a26
SSDEEP 98304:1jMQZikLH2tMPwSGBNumogFJlFlh1wTJntwyqWBsCiLeD8crwrb:tMqimHmGfgfhyTh8YsCi6Qckrb
TLSH
T1FB362302F2E4283BC6DB31766C6BA161B73444471068BD2E7A9D52DCAF5492802FEFF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\2dRhfF\resources\app\index.js
Size 240KB
SHA256 176f28d4929e80b0039851d31297cc3db98cfc2813216ecda880d7dc63668618
MD5 54e9cc07b1bf0158f749a741a23921fa
SHA1 d811807a19ae6d733b9cd902e700f7d836862b77
SHA512 26204d6fe601cf916d30cf3f984a8ab272a422f3b5bc99c65fee7bc56a8302e0e45a98dcfa9165ef19286c3ea8cd89a377b250726dea3ab2e56b430b13f325d9
SSDEEP 3072:/hprLsKuviSpbMECceMtJmCC4j9X1aQllVO1V:/hprLs7viShChMtVC4j9FU7
TLSH
T1303495843BCAA0D2421935F1063F3615B56E4D627A0CCA88D7FAB49EFDB930594B7E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updateInfo.js.map

Path C:\Users\Admin\AppData\Local\2dRhfF\resources\app\node_modules\builder-util-runtime\out\updateInfo.js.map
Size 68B
SHA256 7318ccc42e283138707b3e67f39f03753f5ba998ab0d4e5bbe28fc79bc4f28e4
MD5 8d7f8e1cbd902a2427246d4831e90812
SHA1 608ab180e80eec4ce60ecad7fbdbabc055820342
SHA512 b6b21a0956d75d56105fcd38af04fe95bea39401f968a93873282d46f0919fe36c8fa91a330b08d91ed71927b35ae6830bea07dcad5a0fe4f5b75dd9e5a6b028
TLSH
T1F5A0028B58706F711F1007A908551FC272E1905AD80D405CD8D58C88573C01E4DD5C13
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\2dRhfF\resources\app\node_modules\cacheable-request\node_modules\get-stream\license
Size 1KB
SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
MD5 d5f2a6dd0192dcc7c833e50bb9017337
SHA1 80674912e3033be358331910ba27d5812369c2fc
SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
TLSH
T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\2dRhfF\resources\app\node_modules\clone-response\LICENSE
Size 1KB
SHA256 861908ec818ff6142fdd6c4b66d6264c206d3d5a46003b1342e1853a9a85abac
MD5 9a2baa6947d5018096b83508bd94026e
SHA1 cbe9761d4d16ad1a0a2007b305bc2951bf94be98
SHA512 6fea6e2f30885cdd6cae236637ef194fe9eb06276437e370c02eac651e170031980ab201ff5e8a95b7b5c21f24788fa93807d6c4f2cf79d5f71792e6e8a61fef
TLSH
T10C11421E72510B76189A13A05579A8D9B22BB25ABAAF2A84146EF245232A06CD5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\2dRhfF\resources\app\node_modules\defer-to-connect\LICENSE
Size 1KB
SHA256 0194571d45a06ea2a22ceb51f981e3be92525966d28847dbc0d9982603bf90de
MD5 78fd36a7284eb85369521bcb6e863186
SHA1 8ab3afa5af90b0fa4421252da279bf563b3c47b9
SHA512 265c0b9cb7e34ea63851a6bf0da02cd3da5beb2839b79bdec72607b26a5aeb0f34a812f37941d77c692f9f9799a706de704f41c9e0f360b8d40dbb9d0b416481
TLSH
T15511755EB251077228AB13A05578ACD5F23BB25F7A6F2A84246DF345233A06CD5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\2dRhfF\resources\app\node_modules\is-svg\license
Size 1KB
SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
MD5 915042b5df33c31a6db2b37eadaa00e3
SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
TLSH
T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

pako_inflate.js

Path C:\Users\Admin\AppData\Local\2dRhfF\resources\app\node_modules\pako\dist\pako_inflate.js
Size 106KB
SHA256 ec7e5936c652800e132c63cc1fcd00c23103a6a10a294ed3736bab70e38fc592
MD5 18ba5b8f0f9d69b8443df838577b59c7
SHA1 f21e39c5004036d69c56ad7b0f81607d9687714f
SHA512 98eb3873b102823c64154922bc5bb60107a8e78de7ec8e0d7a9b0d332be23fc6c8eb456640e5513f193a7d92f33ddd0092bb0688e3ee29ea19a3516b5fc2bdac
SSDEEP 1536:VWiXPnKsErlxSelzMs7GfJUVuNhaScFDYRe:fs6ON7E/a7x
TLSH
T104B3F84526F3221B181660B5DB8F70A567E6911F430BD9643CAE83847F9063E82FDFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\2dRhfF\resources\app\node_modules\pump\LICENSE
Size 1KB
SHA256 3fe8d55a98dbf260eace67c00cf9bc53edb46234e840098a0b93df3096b97fb6
MD5 9befe7026bf915886cd566a98117c80e
SHA1 a95ab3a4b0e4bd978897f09b3b430a449da20a08
SHA512 b52ba143042812d6dd1031a12946afddb6e8f8ebbc7169c59c138d16aafc5e261aae92fe6b1ea94a3d80e39d2415c4b219710ef46939a2df135db24a0cf712fb
TLSH
T14E11B91E735507761CAA13605579ACD9F12BB25F7A6F1A44146DF340133A06CD1FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\2dRhfF\resources\app\node_modules\semver\LICENSE
Size 765B
SHA256 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
MD5 82703a69f6d7411dde679954c2fd9dca
SHA1 bb408e929caeb1731945b2ba54bc337edb87cc66
SHA512 3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46
TLSH
T1E401FD9FB2E26BD458D09B603DA16DC962CAB03B7803AA152468E298DB7740FA47A400
MD5 SHA1 SHA512 TLSH

Submit Download

angular-sprintf.min.map

Path C:\Users\Admin\AppData\Local\2dRhfF\resources\app\node_modules\sprintf-js\dist\angular-sprintf.min.map
Size 429B
SHA256 3d6885b5d3ebce0c1119d558c8784806cc79f076a5af8279051b7e94c412b697
MD5 88110c6656f210b1a33dfbacaca20bc8
SHA1 7e346bf1faac9cf2a443b934627d644c4a2a1e1e
SHA512 580fff2450e6afcf8be2d46fb46babfa89c157488cac31b322de78869ec3027067d345360cbf5a63b77a008f5213a608677263a507102e580f067a173a67d417
TLSH
T102E0E5F4CCC96D1869394DD9E4990E4C2BCEC09A7EDDF3114A94C56C4421F0DF0A0430
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\2dRhfF\resources\app\package.json
Size 326B
SHA256 ed559a3a3027667ce6302f1debaed9aef5bef1c6d4236ec4da01199b398f78b2
MD5 48f234e36eba960bf0f66519a219e17e
SHA1 988d574c95e613f177e81417c590540f77ed9845
SHA512 08ac57c789dd209ceebdc73d5ee709ee141811f0955b982454c3459eeac9353eec08aac68646d18c55a181a1f5f64f56fcbebe203597dabef54f2deb40e5e276
TLSH
T128E08C18DC499E23129B888A3068014728612C079959F80DB79E930C1E5C96FB2FCAAD
MD5 SHA1 SHA512 TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\2dRhfF\v8_context_snapshot.bin
Size 160KB
SHA256 31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790
MD5 b64c1fc7d75234994012c86dc5af10a6
SHA1 d0d562b5735d28381d59d0d86078ff6b493a678e
SHA512 6218fcb74ef715030a2dd718c87b32f41e976dd4ce459c54a45341ee0f5ca5c927ad507d3afcffe7298b989e969885ed7fb72030ea59387609e8bd5c4b8eb60a
SSDEEP 3072:pBgpuz1xV9mRTUAnPH5lZw15qCy0CmiRNiA0hTBAzZs7q/JBXTPv:p4O1xoTPyqIRhTBAzZs7kJ1TPv
TLSH
T1F2F3121427D0829096ED4094A25B06E7C5D26C6D1E2CFF0A3BB5FD4C0AA3DCE55FE1B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5f2e336f75306722a284bc15d96d26e4c1e512a5e40f4e2a8463a4b737555a19
MD5 bf850a90bc6651893a9645f28b52cebc
SHA1 13e20846eae1f541a914a06c92719cb88204e5c1
SHA512 2336160bcf57510a21b8332a72f5cc811241e7ebe4f00e01e0e9cd6c31a492cfdb318dd21e306e325118bcbb2a8b7ea0cc0d782fadfaa569d796f98318fbfcda
TLSH
T13E519DF7D3E48A7DC511A6F49B216E1FCD3D0A24122C3D6688D4AF5B53E2872D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e0f6ef7722039959fe7d1c8b18cce8d3ae48125cd7d59b3e8ccdca5dc9f00b13
MD5 af4b01b73a5c726e6754573d85dec568
SHA1 ff1d0c844b14aa9c6b9d07d8fe03c82efb63d482
SHA512 3ecbc02019a2934b290d950c8d45328a3c1394e281f04ccea5966534e9f733f379e2701f100dd827e5dd6a0dc56ed941c0707809f4003d0f803581448bb819f7
SSDEEP 192:iRnDb44Av7sAPRp2X964Hsb+WNn3r40EP2GeL0G6TaO5VyIsnAUgR:iRnX3cBXUbwb4022cPaOfR
TLSH
T1E132843EBA64697B6DDAD219F9213B53E7F5102221942E84FBFC896C14E76CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d6c91312e3a4d0961df7e7f75d035f14c205a98d71426b5216ac19425e13eb86
MD5 3bcb54e7e6ceb6a7be0acf655fd9acb6
SHA1 c1b7ae581f2fc70531f0f3d043bcd016e0db3275
SHA512 063f5b616b9d6eb34b169016e33e4527de66203037dca8f93d8f429d38e19cc014c7cfedef0207647f8d62db6bcfa602b7646d4279cced288d39791137794aa3
SSDEEP 192:iRnDb44Av7s6PRpMX964Hsb+WNn3r40AP2GeL0G6TaL5VyIsnAUgE:iRnX3cHXybwb40K2cPaLfE
TLSH
T1F742B43EB964693B6DCAD219F9217B43E7F5102221942E80FBFC892C10EB6CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e3e783e59d0fd708c3636037d3d2ec74c89c3cd4063ade60682195473fb58276
MD5 380e8c08f53562af479c6e46aca41f2e
SHA1 a4515e570abaf7676c495dd707d4bc7ed56df9e1
SHA512 ad9863420c904d3de28a4b6783a12f24926e343b90fe10071f049ef8bcc14a48ff28a22a31fc473ea37016a468d87d7dce596c31f9c5b19a596f117febb5c4ec
TLSH
T14DA0021197D42C19CD166670B161154126A248D82952FB0F94B1044DF9DB1C28215104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 3a404b454be906a66fb70ffebd8f5b77f72424e030f6b9923c8d9c1885439858
MD5 745a1d97c56b30cc29e7bf979cd621e0
SHA1 305f79126cf2f2a12d3d53de1aaaddec869028b5
SHA512 6452f55089f5b92ffd86000f92afc54c1838703dd5a6987b4c256febd8b80c567a26496adf2ae95b6970a60f547b7a6378bc3e6fbcc84b90da7fbf9c5ba24a20
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 edec6c88ba0e2bc3c45a5be362aa4d0b5a0f4623e283edc08b77beb6f8fcbffb
MD5 dac3319834852509062ef25b6c736349
SHA1 29e2f3fa4fbe131f2c2907cbbcf90d623a24f8c1
SHA512 07495aaefdc5634a2686f8d831dc063aa224b4bbcf5fad9a011f47b66cc87e87171dcc2fe0b2587464823d7ea13f40259704c3d18e6b3d1fecabdee42c7c254a
SSDEEP 3072:8oXymQ4GL9hAq6gWTgD9gco4fQJPK3KXk/je:8o12X6gTgcJIo6Xki
TLSH
T13ED3123028740F17A6C9DA02E567AFFEC8B4DB779A04FB18076BBB98521F2D44305976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e8f4b8321a539511ade83cea03399a99d6ed05b12e7a781188fdcbfe3ffac12b
MD5 5986b124bff0ccddfda70e5b0354003a
SHA1 38bdc403662a288314412762cc9000e58c4942f6
SHA512 ed49b03643f8cdf478bc684a76f7789adea590dfd36239f0a0ea52cd87169611d23b5f1c4835451047e4f199b557abe2744de73987a058af4ea790281ccf4a4b
SSDEEP 96:QC61d+cAOIt5aDVmufj77cmSl8h4otop5OpDFB6QGyv9JtFiO0AuSwfSDYc0j9IX:QCqLA/TE57niU2o78+tFGSwfSDYcUZv0
TLSH
T1D0C11871B8BD6D726DF69554F5427D43CEB4A067A912AE84DAEC4F0C01E70EC2342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 3a1d2f743318eb28ad341d7e62ae3331dc51556722a9e7d975a3ef3c1ea8ab08
MD5 ae84aa64fe4a9522fa619199fc30a525
SHA1 8362e6b476ef880d56149d763275c07ac7062535
SHA512 a8a410c19e2086cd2201aea0349aabfba05337c83b9532514dbea6c2a0edcaf94b07bb7f62b8ef14e59a9804b50a2938797a3362ce5ba8b57797b07aaba16bde
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5OCDFB6/dGyv95SYhbb2Jv4a:gC0LA/TE57cDUD57UweSYhbKl
TLSH
T1BEA10971B4B95AB75C75D544F4827E83CF68A113A9226E80D9DC1F0C10F70EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 2ba6e23b7a28472f6bef283cf2b71d6714c9f11f1f2870efa6f6241e5548482a
MD5 c4c9c1863eb66d0d72dfd5610e9c3cad
SHA1 fbc2a4f347d0348dccdeb019605fd8faf5476541
SHA512 5fbd089975d2c25302f5ee719a7a667a8a2a75807ff17cf9b0f2630e767445e6d73809fd7e8a2b1374cae290d5dbd8cc49619316b02c75714369d3a829df3322
SSDEEP 3072:WoXymQ4GL9hAq6gWTgD9gco4fQJPK3KXk/je:Wo12X6gTgcJIo6Xki
TLSH
T174D312302C740F1B9695DA02E413AFFACCB4DB6B9F04FB1C1A6A7B99121F2E44205D76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCGCBPRO1100u100.dll

Path C:\Users\Admin\AppData\Local\Snib\BCGCBPRO1100u100.dll
Size 4.7MB
SHA256 d272ddff64fa79a9dcd965d5bd5fb5839705cea837397ea167aa3cc1f5217d02
MD5 827f6705fcdf072e512172f64255ce5e
SHA1 19fa45133abef1b7052250388b5c3e3d355b6c49
SHA512 6a3ea037632d103717d79c2b49c2578100d7c8bca11990b61bc345e6e5ff837e7bb170173699f03b256fa90cfe40c4fd7dc2030f1c8b5a983290b8a6900c0f42
SSDEEP 49152:96X4Si1b8x7tHI/q5tJy1Y8e+9Jjvjnz89YusOG805JJODHtgRDyQ401z9Cs4:9Y4Si1AIy5HyO8e+nv/msn5C50
TLSH
T193367C30BE7C0279C5DF95B69E3E366F4D5EAD50072842C75168385AB870AD23633E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clus_Lab16.exe

Path C:\Users\Admin\AppData\Local\Snib\Clus_Lab16.exe
Size 80KB
SHA256 d0713460d93d5702e62af8a22e1fec69ce15ae5f60f1f4a3db2a9701f1ccb460
MD5 f09d5fb0915fe1560743f7f64c84e1b1
SHA1 d89745b7ca2d514505b8a6099ceb0d6cc01cf28a
SHA512 ec68113f0dd28c18aec1e55c30a73705b74cd3d0c253e799f1e57f03435136f72fc6d0739a7513112382c3a26c9e4e4b9f8e8cb039093d1dac1a3e30e22a3352
SSDEEP 1536:ElGPF/QuLkreKqMn/mR3NOuNe4OholRsQ7q/:jPquLkrGrNOuNe4OOlRsqq/
TLSH
T12E832A23B7A98025EAF3A67829759759592FF8301B7482DF6B840E4D1C70BD18D703AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateMiniDump.dll

Path C:\Users\Admin\AppData\Local\Snib\CreateMiniDump.dll
Size 15KB
SHA256 e6198c53a1999e30a620a6057b4efa3ee11193adcdbf3f343859f33eb8e0f4be
MD5 2c3a7c4d149514fa57f2f6b41185ced1
SHA1 38fddc0a01bc7dc32c856d61923e17cc87cd07a7
SHA512 de42735c914e354e2fa6833638151424f2713a874cf45dfd9499962a90c90073b53595a18ee1e082154a64f5ac0d1055d2d8900292ec9e7f00369e8c1e4a78a4
SSDEEP 192:5o88IvAcKi5U2ZOBBG+vBtV+3X3PV26A1Tp8Yu8nG8HD/w2OndRaT3wWFC:5b8Ivl5RZO/VbVinPVkt8SjHbsrSfM
TLSH
T12E7239E1A7A510E2FFEA0FF035F5D3934C393AA23FA6507B9291819718E0790F514769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FeatureSwitch.dll

Path C:\Users\Admin\AppData\Local\Snib\FeatureSwitch.dll
Size 51KB
SHA256 e3a2f6e93119f72cfcc5a384deded9e25fa6872076c6537b3e36b5da472b1d85
MD5 815db1aa9a9000fd797e979497b87384
SHA1 f72095456e81d08c5c36e92407d54e9bdba93dfa
SHA512 16562c85d88773759a151ecb250901f5b8f3ebb0c82dd082a05cb303701a0ff415121f5ac10d88c65530b627cbf6c757b7429c4e84605e408b6e02c0707dffe4
SSDEEP 768:HiymPQ30UWxfPugpf4yNgYA/Q1K6h0santEDpm4xeZ5vy5k+QFbtF7su:CXshaA/9m+65krhF7Z
TLSH
T1BA33380576D58033E3A75A382AB4D2B58D7FB8422BF1509F2BA509BD4FA17C1D938336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP100.dll

Path C:\Users\Admin\AppData\Local\Snib\MSVCP100.dll
Size 411KB
SHA256 d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
MD5 e3c817f7fe44cc870ecdbcbc3ea36132
SHA1 2ada702a0c143a7ae39b7de16a4b5cc994d2548b
SHA512 4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe
SSDEEP 12288:zNb8zxr1aWPaHX7dGP57rhUgiW6QR7t5qv3Ooc8UHkC2ejGH:zNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eKH
TLSH
T10E9428237A4649F5E1D223F46289932143F9FCA40721B3C3E2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PPUtilLib.dll

Path C:\Users\Admin\AppData\Local\Snib\PPUtilLib.dll
Size 283KB
SHA256 aa4e0509b93a8ae6f4203aebb57e51e4a886bfc92f5650d3941aa97f0924bb54
MD5 f6832bd8caba758d758109ef5b31db78
SHA1 157af71e96a98af67441c6b48b67b37d0c2a9719
SHA512 6b750ce919eb83bc218017aaba5c7976e14d580b40ac20bf8986ed699ba2f91321c26783aeb5ca212c6f582ec2a1e26333af454925e3c7b26a46f05d4ea46ea6
SSDEEP 6144:R6MpA+1jGatz2uIO8fGZT/TCg1mOZjv+9q0/G:hA+Y+z2LAbCAv+5/G
TLSH
T1DC547D6077658C37EAFE02349DBF6A1B952CAC510774C1CBA3589EAE68321C35A34787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cachecore02.dat

Path C:\Users\Admin\AppData\Local\Snib\cachecore02.dat
Size 27KB
SHA256 f7ef0f0ef6e15d2b4cede10876a6e0282df7c7602d2107fc5c756f7f7eccfedf
MD5 63a0662bc727bbdf37e77695fbec683e
SHA1 8793d98aa5c9aa9e0346dea27d11f4c25d291bd7
SHA512 d5aa8113ed13f0d9d85f062a8e3c09ff0e4b3afc9c6bbd53ffd0d7a91a0d34400aa871be193f368e90b04ace7bbb58e70b5d6b118fe05ba6c1f004096c6dd0e9
SSDEEP 768:CphPpesnbETdOWXG1LxsAp5pTszMQvBOyogL:6hBznLgCLxlxqMQvBOY
TLSH
T1D7D29D66ABAC9A42E809F9F18934E0E2C3C4F4B57C5F106334A9290778626B9F071DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc100enu.dll

Path C:\Users\Admin\AppData\Local\Snib\mfc100enu.dll
Size 53KB
SHA256 6fec7c478f790d0edcc4f0efb2594a64878ac8fc8878b03f3611311c920e29be
MD5 f908fe45f8fe9e0d4cbe65f9ff5df6da
SHA1 55bdf4ad2db61b8cd0b37011906b74a5505b3746
SHA512 5f02643bc0f79129e2f48349d8594bbbaaceed50146b82ad880e27b6a512f263fcd69f2ad8e956bb147790f05afe64729de4a699261019ab509e89be863f3063
SSDEEP 768:BgIdijcuEhCgyYo6B1CLPLNq5f/nWHBNheOU2fd5SMi2jXHUQ:SI0ifyYo6B8PLNYf/nWHNTdr9rHUQ
TLSH
T1AA33736263FD8605F5F77F752EB556605E36BCA2AD38CA0E1640A14E0972F40DEA0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc100u.dll

Path C:\Users\Admin\AppData\Local\Snib\mfc100u.dll
Size 4.2MB
SHA256 24bb6838defd491df5460a88bed2d70b903a2156c49fb63e214e2c77251eca71
MD5 f32077df74efd435a1dcdf415e189df1
SHA1 2771393d56ff167275bf03170377c43c28ee14e1
SHA512 fb708e0949854998fb80635138c80ac05d77dca3089d3e5974663ddf2376d6a03535dae1a068514c3b58bc06c8e4078b37cfb6bc90f080f7f31fefc972a34850
SSDEEP 98304:jsWbb5oF0MUVVsK3vOGH+1TSlUE7vrffTTnm7ulf67NACOub7FLOAkGkzdnEVomK:jx5x3Ii6F7FLOyomFHKnPA+
TLSH
T1E5268D217EC941B5CDD721B0069DB679932EECE4273006D351953BEBE8383C16D39AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Snib\msvcp_win.dll
Size 493KB
SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 7762c51ea02eb943183d597ea0ee5530
SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
TLSH
T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Local\Snib\msvcr100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
TLSH
T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.dat

Path C:\Users\Admin\AppData\Local\Snib\storage.dat
Size 4.9MB
SHA256 102dd119e4addf303372101f21eed111fc38018283faaa8f64baf506a6279d68
MD5 d3c6051bcf7a84ce8b44ae0b1215f98f
SHA1 90129ea76d33ffd20a033eb777aaa33845e080b9
SHA512 2b669ea8de7ae43cb974cdc40e0dbd9a0fb1f0ee5d7b3f4ddcda2ced3391148901143645a2c9722b8ebd49112f9bdd066ef1c31d9bcc8092caa09a3d90852527
SSDEEP 98304:9O3KwFYliyP9U/Io03VRx5rk3JLB57+fE1Hs6NIipRYA7aFT/qlzkSJf/6Ih/aUT:kKwFYtmrS5rk3JLB57+s1M6PkdZqVCIJ
TLSH
T11A362380DF5E9CF9DA6B0EF5B4F0D31225EFE36CE16871E821C545ABC8C5E5068A2630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Snib\ucrtbase.dll
Size 1.1MB
SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 c4a25dce665733663284750666684703
SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
TLSH
T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcomp110.dll

Path C:\Users\Admin\AppData\Local\Snib\vcomp110.dll
Size 123KB
SHA256 c6abb895b7fef1e280b4e16ada97e29fabc2898c769ceb0095c8949a9fee832a
MD5 eacf968779a18f597945143bf35a5048
SHA1 d9cc6d39247478d002bf845c57a39bbe6c6ee2ca
SHA512 0f45ea523e8990f59f928ce5189584afe03a8649e5763382225462542037a0ac8afacc3ff1c84bc489deffc512d8508f2aa70eed8f45eddfd3a29a8aaa8ff75e
SSDEEP 1536:X3ZsWjcdKOOATsWHKwzVt8xLYRf8BPHBf3vXUIk/17gglZeLSrJXU2d/ZZCkOREx:X3mPHXtXpNlZbXU2d/XCPREb2k
TLSH
T1EAC36C0277E08076E5BB493856B8E5235A7F3E778AF1DC572F84049E09707C1A635B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DBKX.7z

Path C:\Users\Admin\AppData\Local\Temp\DBKX.7z
Size 18KB
SHA256 65306d94eb516e2da2702735fc892ff0a9b85cdb660a1cc9998c08e155353d0f
MD5 a85d2220b722100fe2da7874fb983604
SHA1 6d9b794766206ff9f61b304f69713d1465c7692a
SHA512 70ab9fa7947aa7dc0c5b4023f9f4487fd8e206bfda340dbe992a0300ef37b6ad904d77f5628d3d933fc8c2c75ae01bf791ab24c2a58cdfea854784a3f65538f6
SSDEEP 384:BtXtHLgM77ECU8x4MasTnxFHurH8/ATzw38/97yT3ZyGunSJlg:TdrgPCUCTNTn/HurHP3w38RTGumg
TLSH
T1DC82D090022E941D0A818BDD82127799D17A8ED27973F0D3B5FCD4CF3D366E09E9A276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3404_1390646565\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

e59d72c.msi

Path C:\Windows\Installer\e59d72c.msi
Size 8.7MB
SHA256 f3d69fda955e715bb7ebc418db1e8a21bc5a8e05f38beb879c55087c7e21efb2
MD5 b86bb00857035f4dec9518de7623bc4d
SHA1 e3af411d17987883fb4458f6c1ac372606b7adf0
SHA512 1d1618154c8e5442816b81d7e3bb9ecaafeb565b82e424dadbc226772c3b85610fe4a188a78c07c0b56571ff91fe35f15a4bd0f9bcbc6c9162ea40763d272e1c
SSDEEP 196608:z6nI46JZk2z8mCPrNhvAXosm1RaxUHAoAOKDFOj79OW:z6p6J22z8mAHa412OAVF8O
TLSH
T11A96331D36990B3DCF167DBA54279B00816E2CFC368A877A2E54F2D3B433905799A372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 ddbfddf260e58709aab41ee07cd46f2a6a7fa094ed9dc195d862316f92588539
MD5 387d55e7e777852f18effce83f4caa3b
SHA1 5e2b6c10620cd4e8dd25637b99a6a0fae0527122
SHA512 ffb56c5c5e34a656b4cb4d5cf8fa2e8f54926b51f62ab83f7dd406d30b1d3834309c8326fc5102ee399cc057380c93b907a55033aadc04dccff2792a153e1343
SSDEEP 24576:PFo3DMPsdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+j:aHI
TLSH
T16D57B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{57ed20f0-eb2b-4e87-ba4c-720188da9f6e}_OnDiskSnapshotProp

Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{57ed20f0-eb2b-4e87-ba4c-720188da9f6e}_OnDiskSnapshotProp
Size 6KB
SHA256 3d998de91b03da16b74e7b29b7a2cf89ca55b790610a33b8b3c149512dc71148
MD5 f02a499ebbdce9a8b31ffab5fe8e74c3
SHA1 db0aa2f7aaacd87e7bf401fa77d549d3fca3fdf9
SHA512 17cb9fb89e7dcc89538c10a61b80eea02a90ab71b283fbb2cf7170740c2313ea8873962cd4c155c1d0b5fb0d50b9b8bec2faf94ed36ecf9376afbc553219aed2
SSDEEP 96:FEIhbXvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:qIlb++uVmN
TLSH
T159D178085AF54711E2B3AB3228F14557A837B912FF33CB8E0198238E6671910F975F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2816-72-0x0000000073B00000-0x0000000073BF5000-memory.dmp

Download

memory/2816-73-0x00007FFE70400000-0x00007FFE70663000-memory.dmp

Download

memory/2816-75-0x0000000073B00000-0x0000000073BF5000-memory.dmp

Download

memory/2816-78-0x0000000073B00000-0x0000000073BF5000-memory.dmp

Download

memory/4292-2000-0x000002BE62D20000-0x000002BE62D4F000-memory.dmp

Download

memory/4292-1942-0x00007FFE6F720000-0x00007FFE6F721000-memory.dmp

Download

memory/5260-2023-0x00000179B9FB0000-0x00000179B9FDF000-memory.dmp

Download

memory/5996-56-0x0000000073B00000-0x0000000073BF5000-memory.dmp

Download

memory/5996-57-0x00007FFE70400000-0x00007FFE70663000-memory.dmp

Download