hijackloader | c77dc176b6b643e833ce40829cfbc783b7a0ec317ec12e35095e6523dfb73d8a

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 9.9MB
Sample260822-ajdztstyay
SHA256 c77dc176b6b643e833ce40829cfbc783b7a0ec317ec12e35095e6523dfb73d8a
MD5 1467f5f92f91eb363cfaf1c902ffb0a2
SHA1 4ef9c4468fd4f3ac58a083393e64dcc093ebb3c2
SHA512 5cef73fffcbd97c014227384a243bbfe2b439ed63c4d907458c36efcbc4f269fd71433e739e2ba2391aa1d2161c891dbc69214c3b66b1c734aae2fd3e3d8bdae
SSDEEP 196608:+ppHDvWq069kN6ncZi1UGS4M4RoLEvL10dshbJC7X9V0IvTahm8x:+pp2GK6cb0MNL+p0oy91vWhNx
TLSH
T161A633533B46A4F1E02A9A316FC7DB0702B7C77D1615CE7B61921ECEACA30A11A475CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\ORCLruntime
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c466-50.dat	family_hijackloader
behavioral2/files/0x000d00000001c4a2-123.dat	family_hijackloader

Executes dropped EXE 3 IoCs

pid	Process
4424	Builder-Turbo.exe
3412	Builder-Turbo.exe
3780	Builder-Turbo.exe

Loads dropped DLL 34 IoCs

pid	Process
4424	Builder-Turbo.exe
4424	Builder-Turbo.exe
4424	Builder-Turbo.exe
4424	Builder-Turbo.exe
4424	Builder-Turbo.exe
4424	Builder-Turbo.exe
4424	Builder-Turbo.exe
4424	Builder-Turbo.exe
4424	Builder-Turbo.exe
4424	Builder-Turbo.exe
3412	Builder-Turbo.exe
3412	Builder-Turbo.exe
3412	Builder-Turbo.exe
3412	Builder-Turbo.exe
3412	Builder-Turbo.exe
3412	Builder-Turbo.exe
3412	Builder-Turbo.exe
3412	Builder-Turbo.exe
3412	Builder-Turbo.exe
3412	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe
1140	WavFactory.exe
5436	memu.exe
5256	OrbitDoc.exe
1104	memu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1140	WavFactory.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 3412 set thread context of 1140	3412	Builder-Turbo.exe	92
PID 3412 set thread context of 5436	3412	Builder-Turbo.exe	94
PID 3780 set thread context of 5256	3780	Builder-Turbo.exe	95
PID 3780 set thread context of 1104	3780	Builder-Turbo.exe	96
PID 5256 set thread context of 3408	5256	OrbitDoc.exe	101
PID 5256 set thread context of 4556	5256	OrbitDoc.exe	129
PID 5256 set thread context of 3408	5256	OrbitDoc.exe	101
PID 5256 set thread context of 5392	5256	OrbitDoc.exe	136

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	OrbitDoc.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	OrbitDoc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\web_micro_x86.job	memu.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Builder-Turbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrbitDoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Builder-Turbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Builder-Turbo.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1900	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318313530322097"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5256	OrbitDoc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4424	Builder-Turbo.exe
3412	Builder-Turbo.exe
3412	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe
3412	Builder-Turbo.exe
3412	Builder-Turbo.exe
1140	WavFactory.exe
1140	WavFactory.exe
1140	WavFactory.exe
1140	WavFactory.exe
1140	WavFactory.exe
1140	WavFactory.exe
5436	memu.exe
5436	memu.exe
5436	memu.exe
5436	memu.exe
5436	memu.exe
5436	memu.exe
5436	memu.exe
5436	memu.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
1104	memu.exe
1104	memu.exe
1104	memu.exe
1104	memu.exe
1104	memu.exe
1104	memu.exe
1104	memu.exe
1104	memu.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
3408	chrome.exe
3408	chrome.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe
5256	OrbitDoc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5256	OrbitDoc.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3412	Builder-Turbo.exe
3412	Builder-Turbo.exe
3780	Builder-Turbo.exe
3780	Builder-Turbo.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeDebugPrivilege	5256	OrbitDoc.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4424	3320	setup.exe	89
PID 4424 wrote to memory of 3412	4424	Builder-Turbo.exe	90
PID 3412 wrote to memory of 3780	3412	Builder-Turbo.exe	91
PID 3412 wrote to memory of 1140	3412	Builder-Turbo.exe	92
PID 3412 wrote to memory of 1140	3412	Builder-Turbo.exe	92
PID 3412 wrote to memory of 5436	3412	Builder-Turbo.exe	94
PID 3412 wrote to memory of 5436	3412	Builder-Turbo.exe	94
PID 3780 wrote to memory of 5256	3780	Builder-Turbo.exe	95
PID 3780 wrote to memory of 5256	3780	Builder-Turbo.exe	95
PID 3780 wrote to memory of 1104	3780	Builder-Turbo.exe	96
PID 3780 wrote to memory of 1104	3780	Builder-Turbo.exe	96
PID 3408 wrote to memory of 796	3408	chrome.exe	102
PID 3408 wrote to memory of 1900	3408	chrome.exe	104
PID 3408 wrote to memory of 3420	3408	chrome.exe	106
PID 3408 wrote to memory of 3192	3408	chrome.exe	107
PID 3408 wrote to memory of 3420	3408	chrome.exe	106
PID 3408 wrote to memory of 1192	3408	chrome.exe	108
PID 3408 wrote to memory of 3192	3408	chrome.exe	107
PID 3408 wrote to memory of 1192	3408	chrome.exe	108
PID 3408 wrote to memory of 1492	3408	chrome.exe	105
PID 3408 wrote to memory of 1492	3408	chrome.exe	105
PID 3408 wrote to memory of 4632	3408	chrome.exe	109
PID 3408 wrote to memory of 4632	3408	chrome.exe	109
PID 3408 wrote to memory of 1652	3408	chrome.exe	110
PID 3408 wrote to memory of 1652	3408	chrome.exe	110
PID 3408 wrote to memory of 2148	3408	chrome.exe	111
PID 3408 wrote to memory of 2384	3408	chrome.exe	113
PID 3408 wrote to memory of 5596	3408	chrome.exe	114
PID 3408 wrote to memory of 2384	3408	chrome.exe	113
PID 3408 wrote to memory of 5596	3408	chrome.exe	114
PID 5256 wrote to memory of 3408	5256	OrbitDoc.exe	101
PID 5256 wrote to memory of 3408	5256	OrbitDoc.exe	101
PID 5256 wrote to memory of 3408	5256	OrbitDoc.exe	101
PID 5256 wrote to memory of 3408	5256	OrbitDoc.exe	101
PID 5256 wrote to memory of 3408	5256	OrbitDoc.exe	101
PID 3408 wrote to memory of 772	3408	chrome.exe	117
PID 3408 wrote to memory of 5720	3408	chrome.exe	118
PID 3408 wrote to memory of 5720	3408	chrome.exe	118
PID 3408 wrote to memory of 5956	3408	chrome.exe	119
PID 3408 wrote to memory of 772	3408	chrome.exe	117
PID 3408 wrote to memory of 5956	3408	chrome.exe	119
PID 3408 wrote to memory of 3120	3408	chrome.exe	122
PID 3408 wrote to memory of 3548	3408	chrome.exe	121
PID 3408 wrote to memory of 3120	3408	chrome.exe	122
PID 3408 wrote to memory of 3548	3408	chrome.exe	121
PID 3408 wrote to memory of 2812	3408	chrome.exe	123
PID 3408 wrote to memory of 2812	3408	chrome.exe	123
PID 3408 wrote to memory of 3692	3408	chrome.exe	124
PID 3408 wrote to memory of 3180	3408	chrome.exe	125
PID 3408 wrote to memory of 3692	3408	chrome.exe	124
PID 3408 wrote to memory of 3484	3408	chrome.exe	126
PID 3408 wrote to memory of 3180	3408	chrome.exe	125
PID 3408 wrote to memory of 3484	3408	chrome.exe	126
PID 3408 wrote to memory of 1116	3408	chrome.exe	127
PID 3408 wrote to memory of 2876	3408	chrome.exe	128
PID 3408 wrote to memory of 1116	3408	chrome.exe	127
PID 3408 wrote to memory of 2876	3408	chrome.exe	128
PID 5256 wrote to memory of 4556	5256	OrbitDoc.exe	129
PID 5256 wrote to memory of 4556	5256	OrbitDoc.exe	129
PID 5256 wrote to memory of 4556	5256	OrbitDoc.exe	129
PID 5256 wrote to memory of 4556	5256	OrbitDoc.exe	129
PID 5256 wrote to memory of 4556	5256	OrbitDoc.exe	129
PID 5256 wrote to memory of 4556	5256	OrbitDoc.exe	129
PID 5256 wrote to memory of 3408	5256	OrbitDoc.exe	101

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Users\Admin\AppData\Local\Temp\Builder-Turbo.exe
  "C:\Users\Admin\AppData\Local\Temp\Builder-Turbo.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\ProgramData\ORCLruntime\Builder-Turbo.exe
    C:\ProgramData\ORCLruntime\Builder-Turbo.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Users\Admin\AppData\Roaming\ORCLruntime\QESVVSQTHZJVT\Builder-Turbo.exe
      C:\Users\Admin\AppData\Roaming\ORCLruntime\QESVVSQTHZJVT\Builder-Turbo.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3780
    - - C:\ProgramData\OrbitDoc.exe
        
        C:\ProgramData\OrbitDoc.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5256
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4556
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Roaming\ChannelAgent\memu.exe
        
        C:\Users\Admin\AppData\Roaming\ChannelAgent\memu.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1104
  - - C:\Users\Admin\AppData\Local\WavFactory.exe
      C:\Users\Admin\AppData\Local\WavFactory.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:1140
  - - C:\Users\Admin\AppData\Roaming\ORCLruntime\memu.exe
      C:\Users\Admin\AppData\Roaming\ORCLruntime\memu.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:3616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9cc38c728,0x7ff9cc38c734,0x7ff9cc38c740
  2⤵
  PID:796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1928,i,16600486783702673628,5951981825895289302,524288 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,6550849379773134049,18328424774393961747,262144 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,6381973398901977089,14143751289085674049,524288 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:13
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2956,i,7671726921095956600,10390982072548431458,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,8683785670809147839,2551119974432536737,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4656,i,13434497286353906861,15576954815674745938,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4820,i,16494298038932964208,17688210925715788703,524288 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,14307235785679840677,18059000102705972526,524288 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5448,i,16657788827463686513,5115386724371090746,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5488,i,2705550422202504449,13394999914702865960,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,2401554574102034133,9273550194787868639,524288 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5776,i,5071024655409425488,16425897983172056141,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5916,i,14719388624178699039,17164536607236520681,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,16739377377817210389,6807554610643196621,524288 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6208,i,4428485661738692400,14772147092371061121,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5688,i,10048701392616888975,3159537108760876357,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5508,i,14718366346515470205,3844934417550313321,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5496,i,4974456405308747346,15510273748624721368,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,17329268625159832111,3216517867226822978,524288 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4788,i,15116086974976180772,1733332396113869814,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:9
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4756,i,2657451561246528444,5757588548979745429,2097152 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,12244943490926096791,1668431664640139973,524288 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,7976282163367291960,13355695127688652777,524288 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,14235067361587217544,12018624523243841591,524288 --field-trial-handle=2068,i,16038693944438085733,11453755228752286958,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:5624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OrbitDoc.exe

Path C:\ProgramData\OrbitDoc.exe
Size 1.2MB
SHA256 6cff594e416259a78016920ba7a6e2ab37ea07e947e58cdeb5f85f537e0eb137
MD5 a927696e00526d7ac6ca60e824e222d5
SHA1 9c2c15a9b67f58400b5eaf9023a86e2343b61e05
SHA512 4b1b2b0dcf9a02ea7d459fd1c3386686f577a9ed589a126451984887827330378a41b7c515b0ab35a0010fd5393efd69dec7c7e8cd85bfa34e44dac7f29599b3
SSDEEP 6144:1jh9OVFNC+dvTzm6Bcp6qlwA6m2EmoIqqI6qlwA6m2EmoIqqV19QGc70Gk7Z:1WfNC+06BXVF19tc7xk7Z
TLSH
T16A4584511906D37BD31EE430693EB35D01F81DEAAC9A045ECEF7BD647834A3B32A9924
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 eca452a35c9591821feebe422b1c7c73e20690f60ff19b5e6d80c76676434a0f
MD5 d0d7f92b5fa21b5c8d8ffdd2ccd11e3e
SHA1 6b1491533173f7cecdb2d2a03afdfe5723daf592
SHA512 e0fe43e89c96ef394189ff39379b651a59a13feceaefe83d019322ddb0d0b1a1a7849df849e3af300a7c8a6fa958338c8b15066a00ee9ced4741c59c06b9d635
SSDEEP 192:qRmXagJv7pAPRp2o9XxHsb+WNna6deybDrT9+VyIsnAUge:qRmXdJAXjfwDdNV2e
TLSH
T1B732A62DBE11693B6DCBD229F9517A93D7F6202521E52F84E6FC862C15DB5CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b90961e9ae3971456600336ac2404f96b0d82b582fe331edb20cdea1ebad7f9e
MD5 da5721a3ca80d79fdaaa14b2a2c4cb03
SHA1 980292bdf55a93a894346774b1c06aa85d33aa0c
SHA512 42473c1d600f3f70f2642f956c9b11c3c994c67ece263f7801ae893ec23c2bf7962d6cf10e20d05e9e8bbf9b313ef481f3e7cc4f8a99354af194c7a30ffbeddb
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9f6jBTK8OB:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTc
TLSH
T18032B627A48D9E3F4FD8D519DC026F8B6DB5029272780D24A7FF5D0403A978E214A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d24c0b07a27d4d2a49f3cfe9fc3a7ae8ee413080282bc23571e551ba033c8a05
MD5 416ccee9d0749ce5ed57e479e866a1ef
SHA1 a799c4b11121b4e5ee63eeb6822a231151bafe44
SHA512 5b8f02a19a148e669bf95c452236ffd977109cb4ba6adba2827ec417bdb73c978f2c0b2f2272daad4664fcd6a8e952534a5af1f5d2d5e92d01769b3dfd9e4827
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4ee711bfc8181a1349ae090240271a6b82335a64a1bbc7c5c32f9407ae2719e1
MD5 842d847192d477eff2e84a170839efd5
SHA1 1589498912aecd2eb2a92d9a2adacffbebe91961
SHA512 bfd0d36b261d25aa5dae2cfd89307c542a6beacbdfc8082b99d2ad6f7921885c2a6fa917e55ede1a3e64bcf30fd0dc74b0429beb54a7f38f4411f8a7d4cf8cf1
TLSH
T17FA0021242E44491DF2046B070714B4737738D951D7383035EE20846889F6C44185905
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8a042ed5e587f1c00049ae58b24bb7ec5b3eb27c78f6421d798ebbee64ee844d
MD5 3a5a550ac92a2e10639e8fb493a4bc4b
SHA1 12389bda6563076afde0daf459dddb0e47f88820
SHA512 7c20caa3b6c9266c3e3dec75cac27efbcb7e358bd73f07c783ce7b78187bf4e1f91f57f6231aa6de97ec2aea88f37820612d4285997bf7ecdb9017b77dbcc2f9
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5ImDwB6nGyvn0b4T8eybJv4a:xC0ITo+TQ0InDUDn0PPb4T8eybl
TLSH
T1EDA10835A0284DB74476D446B1626A43CFB9706BE972AFD0EAD90E0D15FB0EC1342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 133c7207472780eafd4ef9511a51a3008b4331952f25a2de9461a42908736b4f
MD5 a9954164ab683c946091caceda63cdb5
SHA1 6f825ea9975b53568904c2fd9e0688b5e18b6341
SHA512 30feee1bc886a7ecc6a048c78396e88a92bcf3efd473eaea0cf0829e5c8df26861c9c082bb30f376fe10c64ff590f16d65f08903d8b406278022286836f6b954
SSDEEP 3072:1QkKVct3XrUqFVXTu2PIp1apCX6ZkdPZ/ehFsrmJK2Q:1DOG34qaDpcpCX6OXIsrmoB
TLSH
T152D3027ADD7CA87B3B2AB508920F3D3CCA7D195359890E6CD4C5CE1253EB2844726E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 b9d32e836b38ae399998024d456b4df78a9b0404949c2c02194fed8de6cbec58
MD5 4e660fce5536e087c6a201e5925cfc3d
SHA1 3472a9b1c9d026fac2cc2b4eb417011eb8a8e597
SHA512 0ddd617825bb01e652b8e3aaa32fc0eb3ac14c50329b2f298de6907eae74ebf6eefc1107641228ff666feb2295e102cd1ec6ac2cac441fe0cfe7409fd81a712a
SSDEEP 3072:6QkKVct3XrUqFVXTu2PIp1apCX6ZkdPZ/ehFsrmJK2Q:6DOG34qaDpcpCX6OXIsrmoB
TLSH
T145D3027ADD7CA87B3B2AB508920F3D3CCA7D195359890E6CD4C5CE1253EB2844726E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5A731B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\5A731B5.tmp
Size 12.5MB
SHA256 841dd5127309f99e433a2bdf7d7dcad0708b8f88307938aea2e91c155be0bebf
MD5 1f846642518160eb881d5bf0b059bec4
SHA1 0798dc219721ca55c42436a64ac663058b8d2f67
SHA512 f5b03798253d878db2e948c6e5589ed71e5ee2a39e107ee6d2fdec6f96dcc2f53a6d3bbb7afa9da42360e15ee51c8d818fe779089be7f786a0a8c3e549356806
SSDEEP 196608:/MT7W+lHyPrGopSHsPhPgWCKkRjkqbAUFAJO7K+t7Zpcej100AM1oDJ:IvQrGtMPRzCKkRY58A4ew7HUo0
TLSH
T1C0D6331F89D8567EE96720888A787F163A4F5BC26B8BB001B204D7294BB635DF3F54C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5A731B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\5A731B5.tmp
Size 12.5MB
SHA256 da3f14cea8e4fb065e3e39f7c8cb073b09a19877819a6920aacb0e31f82ec9d1
MD5 170bcd16f5112a800021fe678a2c5384
SHA1 90bc961a14a5e92ad4ce079a541fafadba74d346
SHA512 2cf7440ca61e4778b237e16b6c55afe79e215611967e2f9ec87081e818f2396a1504cf115d91ec337fb060fd8c7a2238ec95afd8ed9a7f11bdb14db6eb04b19d
SSDEEP 196608:GMT7W+lHyPrGopSHsPhPgWCKkRjkqbAUFAJO7K+t7Zpcej100AM1oDJ:jvQrGtMPRzCKkRY58A4ew7HUo0
TLSH
T14CD6331F89D8567EE96720888A787F163A4F5BC26B8BB001B204D7294BB635DF3F54C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACE.dll

Path C:\Users\Admin\AppData\Local\Temp\ACE.dll
Size 1.2MB
SHA256 5b1420418d01ce68c5b5bb9864d14ab9c63947dde31c6692efab7103412eaa00
MD5 ddff4ac4d772a47104db6cbbf0716195
SHA1 338e6226dee87c9a752ccb21fe37eb066a6de9d6
SHA512 8752d271c0de8c11c04dc40c271465a10db38b35fed1a7a27f102a2bcbc3552188d0483f82fcc44bb806ccca74650aa75a02544f018fac342d19a5424d15769e
SSDEEP 24576:rICfjAcykWygmwxeHYuYLWAi+PTMgUnMUp:ECSkWygnhTMgUnMUp
TLSH
T182455C60BA9E8266F6DAA2718E7D7B2F587DD41107388FC3910CDB1418942D72F37A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AFA6980.tmp

Path C:\Users\Admin\AppData\Local\Temp\AFA6980.tmp
Size 40B
SHA256 8518d138bc4f0aaa128b0ea8f66dba0a513983d7b61cd06277ac73400325db40
MD5 40d130d6d06746a40f45f90b61b27881
SHA1 f2cfa1782c5a1f691e6b404d82f7be260e13bc8f
SHA512 95ebf5116798dc94f1b85a378700aee348584591ed4f0c69a3639c5b04a7313667191b057f95652144f54c8029ed82b5d0ad1be1e31c37240e70a41a136084ba
MD5 SHA1 SHA512

Submit Download

Builder-Turbo.exe

Path C:\Users\Admin\AppData\Local\Temp\Builder-Turbo.exe
Size 409KB
SHA256 796023b7ff4bfd922de919b41f682d8c64877df644a263d5bbbe44617642732e
MD5 11eeb592adbf5390da5c9bdff586f9eb
SHA1 124870cb4ea2b17dfdfacad062a3ab63f8e0d751
SHA512 cc457c606ee3df023c1dc1728c6425614ad2429f4830cb89e915ccb00bf84b710912f2dc9decee604db2821aea800920f7f38cfcd3526ae48d65b3bb63ba1d82
SSDEEP 6144:F5mEwLnwn4lzU8JVdIPh8HjDtfBh3Zb0EoZIOU6ywIlISm:F5mEwLnwn4ZUYVdOhwDxJb3kywgISm
TLSH
T1369439617B9AC932E6E312728E7AA78F143EFA314F3652C776980A4D6C712C11D3174B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.dll

Path C:\Users\Admin\AppData\Local\Temp\Common.dll
Size 88KB
SHA256 c2a6e75e71b0d590c45335ef9ea1a28b50ee2e1f599caa0233e558d38e80591e
MD5 35b77b38f58197270fb603bc277648f8
SHA1 ab89bb1873d6339710bc778bff5ff6c7af5d605d
SHA512 1d8f348d153b5d4005491ff69933c8de8cc949fa7506d5fc9cda7fdc3a701edee0b272d1bf69995c453fcf0fe8927d4165fb867beade5e11e2d7c0a1d6d52c90
SSDEEP 1536:/v2B9quCiDc45xv7a35yvZ+VpNZB1OZe5e9MUaJTH:/v2BdDc45xzaWZ+fXB1OZe5e9MUUTH
TLSH
T120936D11BB6A82BBCDCF12B07876D75B513DED900BE403C3E39B6B695E603D21A71206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GmsCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\GmsCommon.dll
Size 137KB
SHA256 f52c0291fa3c8a067c73319ceca2d95dd71ebf5bdf49985fab496c7ef26c6a42
MD5 067c04fa86649fa83edab2b300028f40
SHA1 ce004d8c2bb2a0f5750c9e33bb0ea2fe328d3460
SHA512 74b991622d3f136bc981cd5b626c7f1638641ba1968ed19d9992d56cca5f38588f48b2f41d2f6fa97532dc1bcafe43967a81e6a4e849f9ad03ee335fe9253ed5
SSDEEP 3072:w+ApN7VwcZChxdEcEYOIcOZVPjVwoXsjXd:wN7VwcZYEAOIcOZ5juoch
TLSH
T17CD35C1236E58135F0D967B82EB59726913FB8E44F9512CBB35993190EB0BC20E32B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP100.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCP100.dll
Size 411KB
SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
MD5 bc83108b18756547013ed443b8cdb31b
SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
TLSH
T1559428237A4649F5E1D223F46289932143F9FCA40721B3C3A2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCR100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OeT7.7z

Path C:\Users\Admin\AppData\Local\Temp\OeT7.7z
Size 17KB
SHA256 0e42352d9709c838292e6c6be05501103daad6178606b31f8967c7298338622e
MD5 c1dbf382f91b3b846a1112a87a98d5f6
SHA1 b4afea6557e253a63b2f7f1c41c2ff27ccc6f28f
SHA512 53f81deb44b0302da2c2528befc05af021efd73055116ba1400b9b6a11246949af5c44cdaa3e8342627d45610f9a7c8e16f477d8db55d3914239655af7f8c1e8
SSDEEP 384:xbV3QuB4skME4RZ0DnCJBC1EAq5ns+LIvXTjLmTcDaFhZ:PBr0DOBCfKGvTjjDk
TLSH
T1F682D0ACDD7660B4B26B68ADC66E831ADF5E2637AD3C9C3572010D11D827ED0DF0E606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StatusEventHandler.dll

Path C:\Users\Admin\AppData\Local\Temp\StatusEventHandler.dll
Size 157KB
SHA256 66c51d37ca6729cbc6bdf8d025bf95f6860f0399e550a4680b183f3e5a1c8785
MD5 d50487b048d66210db5402a2e52bccde
SHA1 3e70a1db89816855d8e4e0951feb49f090dab068
SHA512 94107afcdcdb689092a6b403f06d8efc42bf54b55c3f9dd85ac891b34c8c8b43b80661b9a4a045ce90202e283196f0d776367794a59433e52bafd8f82a2f8f10
SSDEEP 3072:YouAnULXIl+FXw9L3NR1jCL9uvjC6MOZb3K8jXgkl:YzAnULXIl+69ZX0uvjPMOZOkT
TLSH
T131F32B6277AA8931E1CE127C5E35A34F972FB9B1CF6145CBB69C8A4D2C602C21D36317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WsmanClient.dll

Path C:\Users\Admin\AppData\Local\Temp\WsmanClient.dll
Size 1.2MB
SHA256 45a4a3b558a2b1d22da86a4db28418c4b30dbfb8bef1f8a16b80779119d10a94
MD5 60329315000781aa1220ebaa9ea9bea0
SHA1 6d105c5cb35d34f67685f94638ce0f2c11128772
SHA512 9ceb3eb9b5addf9c552d2a7d473831b85a6dc09a3e41705df7cfd7b48c79fde47c5f612e591d018d14af45abef70fc3f67eaa91d41ad3d0d45d95f92a54bb93e
SSDEEP 24576:qYk7261jhb7XoJmJGV4LsBlUPn+E7TGhmy0Rv2s:V41NjJq4MlUPn+6Omy0Rv2s
TLSH
T19C457DE237988075DAAC1276AD6963B9487FA3680BF001D3BBD06B9D7C251C35F36706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 485KB
SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
TLSH
T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pipelineparam16.db

Path C:\Users\Admin\AppData\Local\Temp\pipelineparam16.db
Size 9.7MB
SHA256 455e1f40dade56e0df9aa643cee15d632a467290442779bb39897fc58b9f1c64
MD5 953970e3cdba95ee3727bab828ddc511
SHA1 d650c71cf45f5a90d490dac695f74810dcd96af6
SHA512 56901c9fdb50507e998f2bb749e4a733698c55313688466cb667c227d398d0f6c800975ad53bfffef26f2722936e19037a7a564a7e7d0b9a7f0ef669e4fbe9f2
SSDEEP 196608:0u3lcttuZgLSh+vlLm6+sSOUrl1/Cnn19jJbyKBD6vt:0uswmSh6naOyNCnnbFmvt
TLSH
T13DA633D4D28F9F75F3DF40BE9F490A50E0A4B406A767EE11D78B809D085BF0E905A27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3408_63067202\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

servicemgr50.ini

Path C:\Users\Admin\AppData\Local\Temp\servicemgr50.ini
Size 25KB
SHA256 59d77b50665ee7f14d3f327a8ee340829b6bebc4490c452f781109a5343665e0
MD5 9b238e00251b915114ec8c4a9b8b25dc
SHA1 58f9741ba1654ebcd033e4d4a7812aa67cc9cade
SHA512 429ffcad1a0f5efc725b01d5b4a4ae881e9ab685d25e021b3a606f7608a912718fe0568cd9d7bcf7439616563b908a182cfd8434b5f84552e28cf49fd387b032
SSDEEP 768:351lO+QSqAM0cadsRkzPTx5EPQT+wpZ0HW:351lOGqycauGPvyFW
TLSH
T1F4C28EBA5EF34762E40E9C69CAAC9453C744F876B80B85E1BEB3344B7025D94E435E83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WavFactory.exe

Path C:\Users\Admin\AppData\Local\WavFactory.exe
Size 150KB
SHA256 3b47940bd8deaee7449bd14832440567fa47b2003891156359b82338e56076f7
MD5 307208efbf8a7d1706e45c2dcdfdce6d
SHA1 8997863875b046d5a0ef6dbbc5056a72cce9a898
SHA512 a1f55f3e1b01428a41bbd2b7508259f3091c3dca1a97c63c1a65d7db548b9044b565ac34867cc1375bcacf58d15980c510254db2869fef23816a1d43539273d2
SSDEEP 3072:TtxaFrwK/1uTuZ75FzHzDSPq56/pakRUkIFujW:T6rwajZ75hHw/Ux1
TLSH
T1FFE37B6B726410FAD4578278C9929B4AE7B178561B2083CF6361CF963F737E21E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pipelineparam16.db

Path C:\Users\Admin\AppData\Roaming\ORCLruntime\QESVVSQTHZJVT\pipelineparam16.db
Size 4.5MB
SHA256 38b77e5b79223258f9e0674adad3598674c1e1fcdfce758147699b6120429cbf
MD5 d92635ee21e54a74ccc4c75443cb1fee
SHA1 86013dc2ecc4d757f1c4cb8e3cf66bbe3cf90cab
SHA512 10518ce17ae3b8ea07d4a80301c97f2ed06a65482af76c43f27feeb3cff9d1d269a20a1dc60956b4195f96179136033fedde61d85863cf3899ed74c393b9e833
SSDEEP 98304:v2f9BVpJef0EQGeUlGJjS3DZ4fU8EX2YwUga2mBss08Q:OPVpsf+gNefIX/M3r
TLSH
T1EE2623C687DBD864C147E2782309917142F4BE51BAA51EEA4A10A99FFE0D4C5D0A3F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\ORCLruntime\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-174-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/1104-171-0x00007FF9F1F00000-0x00007FF9F2163000-memory.dmp

Download

memory/1140-154-0x00007FF743F70000-0x00007FF7441D3000-memory.dmp

Download

memory/1140-151-0x00007FF743F70000-0x00007FF7441D3000-memory.dmp

Download

memory/1140-144-0x00007FF743F70000-0x00007FF7441D3000-memory.dmp

Download

memory/3412-101-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/3412-71-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/3412-66-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/3412-67-0x00007FF9F1F00000-0x00007FF9F2163000-memory.dmp

Download

memory/3412-69-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/3412-72-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/3412-68-0x0000000074DB0000-0x0000000074DB1000-memory.dmp

Download

memory/3412-97-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/3412-83-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/3412-129-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/3412-90-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/3780-164-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/3780-125-0x00007FF9F1F00000-0x00007FF9F2163000-memory.dmp

Download

memory/3780-124-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/3780-156-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/3780-127-0x0000000074D90000-0x0000000074DE2000-memory.dmp

Download

memory/4424-51-0x0000000073190000-0x00000000731E2000-memory.dmp

Download

memory/4424-52-0x00007FF9F1F00000-0x00007FF9F2163000-memory.dmp

Download

memory/5256-616-0x0000000001360000-0x00000000016EA000-memory.dmp

Download

memory/5256-163-0x00007FF9F1F00000-0x00007FF9F2163000-memory.dmp

Download

memory/5256-160-0x0000000001360000-0x00000000016EA000-memory.dmp

Download

memory/5256-181-0x0000000001360000-0x00000000016EA000-memory.dmp

Download

memory/5256-684-0x0000000001360000-0x00000000016EA000-memory.dmp

Download

memory/5256-172-0x0000000001360000-0x00000000016EA000-memory.dmp

Download

memory/5256-158-0x0000000001360000-0x00000000016EA000-memory.dmp

Download

memory/5256-705-0x0000000001360000-0x00000000016EA000-memory.dmp

Download

memory/5256-411-0x0000000001360000-0x00000000016EA000-memory.dmp

Download

memory/5256-167-0x0000000001360000-0x00000000016EA000-memory.dmp

Download

memory/5256-730-0x0000000001360000-0x00000000016EA000-memory.dmp

Download

memory/5256-733-0x0000000001360000-0x00000000016EA000-memory.dmp

Download

memory/5436-149-0x00007FF9F1F00000-0x00007FF9F2163000-memory.dmp

Download