hijackloader | bfa315c6c37f5bac2c5959d4e606d11ca1ae1a46e09b107e16983709e08538b3

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UTODYIBG.msi
Size 6.7MB
Sample260823-g23t8stdnf
SHA256 bfa315c6c37f5bac2c5959d4e606d11ca1ae1a46e09b107e16983709e08538b3
MD5 cfca53ca1e4f8d8138093a35dff51cd1
SHA1 7291c516ff7cb309ff4db7636f1a0b575a03354e
SHA512 6074c04b5c343a9ab46bdbfa40cb843ca301272d9081ec8282c0c1e58f1019f1fb3b9384b3b8bcfaf0ad5b4d460b9c5b2ac3a8f73353487eba0561c340fc7e84
SSDEEP 196608:1XpOfy4WUFUqXtW0wKm1TqxkIQ70t0aIoHH:1X2fq+E9Km1Tqxkf0tJ
TLSH
T12E66338CF53AAA53D1C9FB399DCD46906FF99E439FA1181E3580B6E409F81E1318E4C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\TCPDisplay
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c536-51.dat	family_hijackloader

Executes dropped EXE 8 IoCs

pid	Process
3676	DigiVector32.exe
4888	DigiVector32.exe
4952	Boost Note.exe
2104	Boost Note.exe
1768	Boost Note.exe
4864	Boost Note.exe
3440	Boost Note.exe
2400	Boost Note.exe

Loads dropped DLL 24 IoCs

pid	Process
3676	DigiVector32.exe
3676	DigiVector32.exe
3676	DigiVector32.exe
3676	DigiVector32.exe
3676	DigiVector32.exe
3676	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4952	Boost Note.exe
2104	Boost Note.exe
2104	Boost Note.exe
1768	Boost Note.exe
2104	Boost Note.exe
2104	Boost Note.exe
4864	Boost Note.exe
3440	Boost Note.exe
3440	Boost Note.exe
3440	Boost Note.exe
3440	Boost Note.exe
2400	Boost Note.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Roaming\\cxjcm\\Boost Note.exe"	Boost Note.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Roaming\\cxjcm\\Boost Note.exe"	Boost Note.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4888 set thread context of 3668	4888	DigiVector32.exe	105
PID 4888 set thread context of 5616	4888	DigiVector32.exe	126
PID 4888 set thread context of 3668	4888	DigiVector32.exe	105
PID 4888 set thread context of 6656	4888	DigiVector32.exe	150

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\NOTICE.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	DigiVector32.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt	DigiVector32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	DigiVector32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	DigiVector32.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	DigiVector32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	DigiVector32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	DigiVector32.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59a36a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF123B8966FB844E7B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2494716C7298EEDF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA89A.tmp	msiexec.exe
File created	C:\Windows\Installer\e59a36c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC2D7242AD96F7F67.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a36a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8E3B850F-8D7D-43CB-9650-604678EDD987}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0AB289FA1AF34012.TMP	msiexec.exe
File created	C:\Windows\Tasks\OrganicWire.job	DigiVector32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4532	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DigiVector32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DigiVector32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2452	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319396497459050"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4888	DigiVector32.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
868	msiexec.exe
868	msiexec.exe
3676	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
3668	chrome.exe
3668	chrome.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4864	Boost Note.exe
4864	Boost Note.exe
2400	Boost Note.exe
2400	Boost Note.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe
4888	DigiVector32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4888	DigiVector32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4532	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4532	msiexec.exe
Token: SeSecurityPrivilege	868	msiexec.exe
Token: SeCreateTokenPrivilege	4532	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4532	msiexec.exe
Token: SeLockMemoryPrivilege	4532	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4532	msiexec.exe
Token: SeMachineAccountPrivilege	4532	msiexec.exe
Token: SeTcbPrivilege	4532	msiexec.exe
Token: SeSecurityPrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeLoadDriverPrivilege	4532	msiexec.exe
Token: SeSystemProfilePrivilege	4532	msiexec.exe
Token: SeSystemtimePrivilege	4532	msiexec.exe
Token: SeProfSingleProcessPrivilege	4532	msiexec.exe
Token: SeIncBasePriorityPrivilege	4532	msiexec.exe
Token: SeCreatePagefilePrivilege	4532	msiexec.exe
Token: SeCreatePermanentPrivilege	4532	msiexec.exe
Token: SeBackupPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeShutdownPrivilege	4532	msiexec.exe
Token: SeDebugPrivilege	4532	msiexec.exe
Token: SeAuditPrivilege	4532	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4532	msiexec.exe
Token: SeChangeNotifyPrivilege	4532	msiexec.exe
Token: SeRemoteShutdownPrivilege	4532	msiexec.exe
Token: SeUndockPrivilege	4532	msiexec.exe
Token: SeSyncAgentPrivilege	4532	msiexec.exe
Token: SeEnableDelegationPrivilege	4532	msiexec.exe
Token: SeManageVolumePrivilege	4532	msiexec.exe
Token: SeImpersonatePrivilege	4532	msiexec.exe
Token: SeCreateGlobalPrivilege	4532	msiexec.exe
Token: SeBackupPrivilege	1196	vssvc.exe
Token: SeRestorePrivilege	1196	vssvc.exe
Token: SeAuditPrivilege	1196	vssvc.exe
Token: SeBackupPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe
Token: SeTakeOwnershipPrivilege	868	msiexec.exe
Token: SeRestorePrivilege	868	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4532	msiexec.exe
4532	msiexec.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4532	msiexec.exe
868	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 3240	868	msiexec.exe	95
PID 868 wrote to memory of 3676	868	msiexec.exe	97
PID 3676 wrote to memory of 4888	3676	DigiVector32.exe	99
PID 3668 wrote to memory of 3140	3668	chrome.exe	106
PID 3668 wrote to memory of 5312	3668	chrome.exe	107
PID 3668 wrote to memory of 2452	3668	chrome.exe	108
PID 3668 wrote to memory of 5312	3668	chrome.exe	107
PID 3668 wrote to memory of 3940	3668	chrome.exe	109
PID 3668 wrote to memory of 3940	3668	chrome.exe	109
PID 3668 wrote to memory of 5736	3668	chrome.exe	111
PID 3668 wrote to memory of 5736	3668	chrome.exe	111
PID 3668 wrote to memory of 5276	3668	chrome.exe	112
PID 3668 wrote to memory of 5276	3668	chrome.exe	112
PID 3668 wrote to memory of 5320	3668	chrome.exe	113
PID 3668 wrote to memory of 5320	3668	chrome.exe	113
PID 3668 wrote to memory of 1244	3668	chrome.exe	114
PID 3668 wrote to memory of 1244	3668	chrome.exe	114
PID 4888 wrote to memory of 3668	4888	DigiVector32.exe	105
PID 4888 wrote to memory of 3668	4888	DigiVector32.exe	105
PID 4888 wrote to memory of 3668	4888	DigiVector32.exe	105
PID 4888 wrote to memory of 3668	4888	DigiVector32.exe	105
PID 4888 wrote to memory of 3668	4888	DigiVector32.exe	105
PID 4888 wrote to memory of 4952	4888	DigiVector32.exe	117
PID 4952 wrote to memory of 2104	4952	Boost Note.exe	119
PID 4952 wrote to memory of 4864	4952	Boost Note.exe	122
PID 1768 wrote to memory of 3440	1768	Boost Note.exe	123
PID 1768 wrote to memory of 2400	1768	Boost Note.exe	124
PID 4888 wrote to memory of 5616	4888	DigiVector32.exe	126
PID 4888 wrote to memory of 5616	4888	DigiVector32.exe	126
PID 4888 wrote to memory of 5616	4888	DigiVector32.exe	126
PID 4888 wrote to memory of 5616	4888	DigiVector32.exe	126
PID 4888 wrote to memory of 5616	4888	DigiVector32.exe	126
PID 4888 wrote to memory of 5616	4888	DigiVector32.exe	126
PID 3668 wrote to memory of 2332	3668	chrome.exe	128
PID 3668 wrote to memory of 2128	3668	chrome.exe	130
PID 3668 wrote to memory of 1752	3668	chrome.exe	131
PID 3668 wrote to memory of 2128	3668	chrome.exe	130
PID 3668 wrote to memory of 1752	3668	chrome.exe	131
PID 3668 wrote to memory of 1664	3668	chrome.exe	134
PID 3668 wrote to memory of 1664	3668	chrome.exe	134
PID 3668 wrote to memory of 2852	3668	chrome.exe	135
PID 3668 wrote to memory of 3640	3668	chrome.exe	136
PID 3668 wrote to memory of 4612	3668	chrome.exe	137
PID 3668 wrote to memory of 2852	3668	chrome.exe	135
PID 3668 wrote to memory of 3640	3668	chrome.exe	136
PID 3668 wrote to memory of 4612	3668	chrome.exe	137
PID 4888 wrote to memory of 3668	4888	DigiVector32.exe	105
PID 4888 wrote to memory of 3668	4888	DigiVector32.exe	105
PID 4888 wrote to memory of 3668	4888	DigiVector32.exe	105
PID 4888 wrote to memory of 3668	4888	DigiVector32.exe	105
PID 4888 wrote to memory of 3668	4888	DigiVector32.exe	105
PID 3668 wrote to memory of 4796	3668	chrome.exe	139
PID 3668 wrote to memory of 1012	3668	chrome.exe	140
PID 3668 wrote to memory of 4796	3668	chrome.exe	139
PID 3668 wrote to memory of 1012	3668	chrome.exe	140
PID 3668 wrote to memory of 2848	3668	chrome.exe	141
PID 3668 wrote to memory of 2848	3668	chrome.exe	141
PID 3668 wrote to memory of 5124	3668	chrome.exe	142
PID 3668 wrote to memory of 5124	3668	chrome.exe	142
PID 3668 wrote to memory of 3692	3668	chrome.exe	143
PID 3668 wrote to memory of 3692	3668	chrome.exe	143
PID 3668 wrote to memory of 3640	3668	chrome.exe	145
PID 3668 wrote to memory of 3640	3668	chrome.exe	145
PID 3668 wrote to memory of 2520	3668	chrome.exe	146

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\UTODYIBG.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4532

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3240
- C:\Users\Admin\AppData\Local\Opera\DigiVector32.exe
  "C:\Users\Admin\AppData\Local\Opera\DigiVector32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\ProgramData\TCPDisplay\DigiVector32.exe
    C:\ProgramData\TCPDisplay\DigiVector32.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Users\Admin\AppData\Roaming\cxjcm\Boost Note.exe
      "C:\Users\Admin\AppData\Roaming\cxjcm\Boost Note.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4952
    - - C:\Users\Admin\AppData\Roaming\cxjcm\Boost Note.exe
        
        "C:\Users\Admin\AppData\Roaming\cxjcm\Boost Note.exe" --type=gpu-process --field-trial-handle=1576,5711200475926684614,5757862987806697751,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1584 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2104
    - - C:\Users\Admin\AppData\Roaming\cxjcm\Boost Note.exe
        
        "C:\Users\Admin\AppData\Roaming\cxjcm\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,5711200475926684614,5757862987806697751,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1892 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:6656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:5936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ff85e41c728,0x7ff85e41c734,0x7ff85e41c740
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,15827918667986851551,12650123850142730364,262144 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,8370661411870250555,1876172660373932437,524288 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,10816249343150751661,5953659001306946871,524288 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,8777056687549868449,11436951976880681555,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,17292264979292849281,11137345656186627562,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4680,i,15171476979185918691,10328063331244689167,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,12410362590263729220,6556087849579589396,524288 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,14158273755419443262,13400525907414557499,524288 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5724,i,9247599653337004828,7985658351268256787,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5768,i,4067836997095732231,5840918499476851612,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6072,i,8728832574539406993,17280257066785516013,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5876,i,12491321199361235175,2670817106682414425,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,2025545007278827785,18028969451119186025,524288 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5908,i,11312019807035196976,1028023590262209652,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6204,i,7702086504560374326,6826196501479251878,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,8051411041853390338,9937670285437082885,524288 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5800,i,18396445237578953782,7381042277602294117,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5588,i,12253175190999984399,13929947497734665662,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,557492261451637709,10419553121154980386,524288 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6072,i,7788487216212239998,8762601824993092528,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5532,i,1525390579992761051,3689410781863102575,2097152 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:9
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6328,i,17821068869544310435,15861231069126895560,524288 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
  2⤵
  PID:6368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,5348206496099545656,1423271263527256493,524288 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:6376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,3113272345671660975,2119474368662359435,524288 --field-trial-handle=1928,i,1320222249073121468,1035849422726484800,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
  2⤵
  PID:6384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4076

C:\Users\Admin\AppData\Roaming\cxjcm\Boost Note.exe
"C:\Users\Admin\AppData\Roaming\cxjcm\Boost Note.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Roaming\cxjcm\Boost Note.exe
  "C:\Users\Admin\AppData\Roaming\cxjcm\Boost Note.exe" --type=gpu-process --field-trial-handle=1600,5556552867513309414,16632835733282257912,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1616 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3440
- C:\Users\Admin\AppData\Roaming\cxjcm\Boost Note.exe
  "C:\Users\Admin\AppData\Roaming\cxjcm\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,5556552867513309414,16632835733282257912,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1940 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59a36b.rbs

Path C:\Config.Msi\e59a36b.rbs
Size 10KB
SHA256 b8d18e882e2c6b52486801e98df214847c12905c0a524ca0973a7a7a24ac44e0
MD5 2f3e773a802018c2092dde3edf84567b
SHA1 1ab9542cdb1862f38f2392f4a2372a38b634f177
SHA512 c76387221f94b7dfecf14c82e8b64f8e9a4fb77f16a7338afb45fa061e56ef22a7c4a612b8e76e88e8f1bf06f27d7396b551a08cf8971bedaba6936d2b13dc0e
SSDEEP 96:yYCAKkbtmJY+ShudW1h814141KP8LJTmFYgfYYR6C+O8IAejIUqW2CsThqpUqW2C:yYCQ8uh5wNClnflI3fl1/FOp4
TLSH
T130226601F284C5C2E9762731C32B2E5C3BB2D7DAD71067461A4DC8649F53ABDEE861A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2835e7ac604fb422c16bf0a9f055c612be6dc67db7a1600f8a5aae2d581883a1
MD5 bb1af960c90f0ef37d2866e15d426e3f
SHA1 7d652350f1fd596e90c7115ec197447a01fb33a5
SHA512 de93194773cca03b65ecd91549ec29eef59d6ba21758dd9de49b3fa0dc912a8c8793a9be4300318850402bcd8858c68881dd0e79db9bc5db5ccc7136943a151e
SSDEEP 192:KRPHVb44sv7sAPRp2X964Hsb+WNnKx0ir24e0KiB8VyIsnAUgR:KRPH9D4BXUbwU0E2uVYR
TLSH
T1E932B83EB964397B6CCBD219F9613B93E7F5102225942E84F6FC992C24E79CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 971581968487aa6de4532fd216bdf034d1928c938dfd047df445ce87683f91be
MD5 e58b7cf7f761c90c674b4d15102eeb56
SHA1 42dc0e2848e430cb044020aa4f6f8a3c7fff925a
SHA512 4a56b5a0ec6bf8c17149c5ac5e2d0c986c15faef7cf37866459feacb6b1e8873050149e2de1028fc66c0b5d980e4574a0a62c7a6c43d81799ac5cf0d5f83eff7
TLSH
T114A0021041CD4411EFC04274F1B7665922A35C546552530364F144969E6F2C09111608
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b8190.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5b8190.TMP
Size 48B
SHA256 323cd8280afc2764010d04a8850be2c0b761413c88aa336cd4dc3f0775a3cbf6
MD5 7059e5826a98f0edaa690bdc42e59ceb
SHA1 e9b7e33679aaafbd1b4c0db68e54e905734f0029
SHA512 3ec0f0bc32eb92b9fe07a32cfdf6323481e81ef81d3f890f0603bb3e563aa9bbbe75849adb45e68d47c4cf10fd007799bb3ec88ec686f44ad933e4b680cf50ed
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 ee9cdc876d6c36a36149f0b96a8ef68ed1ff0eee9f0d6eeab58923f588be991d
MD5 2995d5649ee67f8a03943b90387c4c4b
SHA1 d7472db84f37e8e920510abe9f4e81cd2b7e009f
SHA512 72fff28cb487971246a5395b51ef79061669e840852ccc8364cdd969680a0b572f6d4f828e502b9e4aeafaed3b230d9c138333778325cb8d960c4ca418a9d461
SSDEEP 3072:+5PoycZ4g6S3l7D31LSMkdhnMCO131x8Lu:+5PoycD6S3l/31Xksp91xx
TLSH
T1A5D3125034BCAA5E4F5BC568806F240BC857D046991ABDBD5FEADEC9A0C64E803273A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d8b93c96d51eb34b142e20625f6bd2a4e70f17dbf11d1858a97111db5e3ae060
MD5 f17e4663d22bb79b9fe1b0fac70519a4
SHA1 156ba6a19c00b04b803d43381bbd2de149d6d83a
SHA512 e578f8433e4abdae0dc2c906a9e6ada02bce7fa477a1887c86571e85072c258c50a76ad939844b339d56a3664dce2e4fe7fd5b410dee9d4cb66b17d6066c20c1
SSDEEP 96:TQC6Zd+cAOIt5aDVmufj70lcuSl8h4otop5HpDCB6RGyv9JtFiO0AuSwZ/SDMX0k:cCmLA/TE57kiU2ZCV+tFGSwBSDMXUZvY
TLSH
T17BC11870A8BD2E736DF6E544F5927A83CEE4A067A922AEC48DED5B0C11C74DC1347A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 27e38ab5986f67ab12dc73ab5b79e6984182096a1132592aae08c4b55b95e212
MD5 ca3259e813a1909c2e01ff5bdd40f460
SHA1 5fb0f55fd94d88cf7b753696e4b42c292e700247
SHA512 0b73ae449b37ab3a75c6e756dcd016bbc7642f4bd21808fc7a6bd78420008899fc8a3d42e46c27f9a7aed4e801e58007706bb765e4be8484e647d7c49a127e2a
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5HCDCB6/dGyv95SMhbb2Jv4a:gC0LA/TE57cDUDECUweSMhbKl
TLSH
T1FDA10971B8B85AB75D75D644F9827E83DF68A157A9227F80DCDC1F0C10E70E81382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Comn.dll

Path C:\Users\Admin\AppData\Local\Opera\Comn.dll
Size 368KB
SHA256 4ec6df5aa46eed7eff60a6425e03c73b797b1b653a01c6136ebebfa77f7b950e
MD5 48397e780fa397089305bac4357cd356
SHA1 1db046bd5cf378abebf86d4b57dc0c63723f8091
SHA512 9c8553027e9638b3b94f53911985576a43aa1881ec553114a834716f4eb4dfa621bdb50ce74a311f1656150cdff8e2290fa5ad87d88c07e99ce8b7816135b744
SSDEEP 6144:yoSMWuUiCBpE8Tj7aXmnGBNRJ9i3vfC1GVK6QeXHA4+1CbiuuuvONkij72GTG7:xSM9Z+8p9X6Qp4Bi+ei7
TLSH
T1F8845B22EA05C034F4A70176B7AA52BB5C2C9D3127E450E7F3C499CE95B85F3BAB0527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DigiVector32.exe

Path C:\Users\Admin\AppData\Local\Opera\DigiVector32.exe
Size 27KB
SHA256 ab5b956eca5ce83bf763d5f952316f17ba771adfd5cafd8ca9e262de61de4b4e
MD5 5b8fb06983be9063ef128fa5aee80b3a
SHA1 c065a0ee84eb1fd646ea213bca20543306d7c9e1
SHA512 868cfbf9dd0a4ea9ececb290fa149959416ee2720c09e5bb8722cd1863626794afc2d5770e9244ba4e64b8e88c76e22e13af37aa42d745e1dbff4104258c8da2
SSDEEP 384:w7a2sUoEqtMTJZSeHith5kCcqmaJ4Tl8DDnWhZHith5kCcqmaJ4Tl8v+iLGhGApu:4XsPk5i9YlBhBi9Yldp9E+8iROJ
TLSH
T152C25B935A643401EF939E7073E1C52BAE723292AF8440F765BAC14D1EC6BE0767902E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VC80.CRT.manifest

Path C:\Users\Admin\AppData\Local\Opera\Microsoft.VC80.CRT.manifest
Size 1KB
SHA256 17ad1a64ba1c382abf89341b40950f9b31f95015c6b0d3e25925bfebc1b53eb5
MD5 541423a06efdcd4e4554c719061f82cf
SHA1 2e12c6df7352c3ed3c61a45baf68eace1cc9546e
SHA512 11cf735dcddba72babb9de8f59e0c180a9fec8268cbfca09d17d8535f1b92c17bf32acda86499e420cbe7763a96d6067feb67fa1ed745067ab326fd5b84188c6
TLSH
T1FA319B908C856C16D302D1D4FEF1E92970423F6700BE86EF6DE11DFF6D8248992863BA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.VC80.MFC.manifest

Path C:\Users\Admin\AppData\Local\Opera\Microsoft.VC80.MFC.manifest
Size 2KB
SHA256 4ed3ba814de7fd08b4e4c6143d144e603536c343602e1071803b86e58391be36
MD5 97b859f11538bbe20f17dfb9c0979a1c
SHA1 2593ad721d7be3821fd0b40611a467db97be8547
SHA512 905c7879df47559ad271dc052ef8ae38555eac49e8ac516bc011624bf9a622eb10ee5c6a06fbd3e5c0fa956a0d38f03f6808c1c58ee57813818fe8b8319a3541
TLSH
T1854198508D857816D302D1D8FEE1E92670453F6740BE4AEB6DE11DBF6C8348C96C22EA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.VC80.OpenMP.manifest

Path C:\Users\Admin\AppData\Local\Opera\Microsoft.VC80.OpenMP.manifest
Size 468B
SHA256 be8327c8d71b61893d455130c2b5a8635e451a7d95bbfaf29432b3844a7ac109
MD5 d1240d97b0e1f80d82ad12782dfe8ebe
SHA1 59601898276ff76b40c97d493d4b9ca2de6fccac
SHA512 6c64a46715949c36e26045fcf12dc468c6d39782eb0165f966d251dfff40af2b065283b8f9391dddc66c98a5c3db7b92844e784355d73e1adbad1f37abf384de
TLSH
T1C0F09740C0496E2EAF110A226E63D8482BAD27A3058C4A4C38F87A576E134A842171B3
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.VC90.CRT.manifest

Path C:\Users\Admin\AppData\Local\Opera\Microsoft.VC90.CRT.manifest
Size 1KB
SHA256 382115a60ec7e48894e1c3ba311ec31636443350e11184ce8bf88b738588ce52
MD5 ef6a2dfbd914169a3209137ab7b97e05
SHA1 18962d50dfecdf4486b326e3fbe427ee9715f440
SHA512 7d744e58499644cb1fac3a62534d2b242d9101fc8e63191bc0722cd41fd09d4cfb2c8bfed132f25cdd070ec160aee021b0d21047e4ddd6fe70b1c43a848ee7e6
TLSH
T11B31AB55CD857C169302D5D4FDE2E92671863F6700BE06EF5CE10DBF6D8248846C22FA
MD5 SHA1 SHA512 TLSH

Submit Download

SQLite.Interop.dll

Path C:\Users\Admin\AppData\Local\Opera\SQLite.Interop.dll
Size 1.2MB
SHA256 374b321a7bedd1c8d8c92df1ed6f690d5f0db2ba7fb998e4cc49c83ede7fa0ea
MD5 4de137c88e26250e2a79a4465ef2c943
SHA1 599c147902dd220ffe67095cc2ba3f5dc5953d00
SHA512 6a64ef8f9556118d96b6c96dd106b2616c88ee3244603dd0a26a1ec65b4ea6d203f71b1b7d879c617261edf845f3408183705d193295c77911e4b7d48095d375
SSDEEP 24576:lTvTI7dZjHWU6XWsdgCt/BhRoFBajCMmjHc+rvDpHypVBR0bnBoT:dI7HHlp64vlRA+gpVkbB2
TLSH
T11E457C52F98380E1F9D211B592FE5EB35E3C1209832899D7E3D42CA56E208D3763B75E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dispatch256.sym

Path C:\Users\Admin\AppData\Local\Opera\dispatch256.sym
Size 16KB
SHA256 af5ea9bd65839d71a5977215e827853b1f6c79f5730125fd026aed35411430c1
MD5 397be6849840fc5760523d06fa23a332
SHA1 e4ecb0681da6aefa9bd67401e68b250b92bc8611
SHA512 fedbaf23c748d3a5a4f9f77c904259fa217654ca6808888b9c445b6fd6bcb48201db59205ff41faa55cd71b23aa89fc64d306510cb73b1e8c307b57d5c1768db
SSDEEP 384:4B2pMXaI2Qqk+wtZKbs6DamzJNsjBK7uBpuVBb9B2ltuRnLqMhqh:o7H28+wty33JNsHruVBb+e7hc
TLSH
T1F7726DFAAE636FDBE81B16352861F061DF58FD65B70E10F2B54B040B942EDD27024E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heapext.xml

Path C:\Users\Admin\AppData\Local\Opera\heapext.xml
Size 4.8MB
SHA256 679eea60953236fb9f8f23e251a264c1920ab3fa36f29260b0074fc9cacb49ee
MD5 28664b3ee720554beb9ce18be2236ca0
SHA1 7c656a217f0cdcd25059edacaf29a1ed97a2c04b
SHA512 b856f069d29d68014624a244ff7dc18d7c1d781166aae270980e44f2672820c685081b2c25a8301b1bdd9cdf5380449dce641dea65e05e1ee068dfba5e7e948d
SSDEEP 98304:eqEes4G7i5HjzCEEaQpuSbf0sRxB+ZhC062pKv/Es:eqEeJG7OHjzCEE13bD3B+ZhCOup
TLSH
T17E36234AADC4BBA2C00098F5342C55F2589D770BF724D0C36AD9C490BE47865DEEDAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Opera\libcrypto-1_1.dll
Size 2.2MB
SHA256 803f1d29dc55c60141fc9a61787eacbf989d8b5b4f5c170976ac9f76edb505fe
MD5 0d738804925b1bb6b9990ab6425bde20
SHA1 26017d8436d2bad79166c3930a7e06675f2c67ed
SHA512 c042ac5990aed7d42b7fc68074b543a58934d1518edef6c56dd63fe9a598cfaca63232f6e59a3bcb2bd2249d707a639af9ca964e0ad720cc5258130ded2038b9
SSDEEP 49152:FzbweqQy7Fx+17AOaXN8pBnK8CGS1CPwDv3uFyiZT4oEQ:dbjBy7r+7b8GnK8pS1CPwDv3uFyin
TLSH
T1E6B59E42E7AB55B1D89E8A7D11EB623F8F33A7144329D6C38FA13995AC305C1663D3C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Opera\libssl-1_1.dll
Size 641KB
SHA256 0813c77df688b39f26bad0be2b3e4afde13e97d9a1ebcbdb3b1f4184218d1a57
MD5 cdbf8cd36924ffb81b19487746f7f18e
SHA1 781190c5a979359054ce56ceef714a8f5384cfbb
SHA512 ca43450e853b3c74808ad199abe329ac2a2d7ae2e84c17fb467374c22ec9620fb102c75889e279e2d28f0ebd14d8bafafe700241ba4141fd64b4801802a3d474
SSDEEP 12288:gS8b77+Zdm6b8nU2j64YEc9zYe5ZLKTedJHs8AO6yzBK:gSb9B8TedJHQO68K
TLSH
T1BDD48D92ABD29CB2E48681BA117B177E5E39F3102329D9D39FA11DA88D603D1573D3CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp80.dll

Path C:\Users\Admin\AppData\Local\Opera\msvcp80.dll
Size 536KB
SHA256 ba5b61eb652f28cda1a80e2ee6839bd0bb043a098d0748f4817fb006b6887949
MD5 23901f72d732644522feb91926ae9826
SHA1 ec0b8a7fc5e09f7bfb102397487048e2b30544cf
SHA512 a6f5ba284c4a127ba121cab0b6e13699d7121d883dbfd8463b693883403f603375975897f7148d45de3e7ab9ac7056df7a88e9566ef6f909ba4e82abdfbaf2e2
SSDEEP 12288:oZY4lOHMwLwXBt+iaPztOUa/hUgiW6QR7t5j3Ooc8NHkC2eK:oZY4lOHMM8wiqztuj3Ooc8NHkC2e
TLSH
T1EDC4F82337438EF1E08173F176C50322A7F7BC654625B313A2DBE5652F9A28D6573AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Opera\msvcp_win.dll
Size 493KB
SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 7762c51ea02eb943183d597ea0ee5530
SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
TLSH
T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr80.dll

Path C:\Users\Admin\AppData\Local\Opera\msvcr80.dll
Size 612KB
SHA256 a74e18c475e7853d6158ae668dcc3f6c30c7b9eb7bb2360a8b58d945c1e81fbb
MD5 96c8074b51dcb2bb4264fe7f4566cfa0
SHA1 dbb0ffbd6eba769c223860ac41c1e84223d40ed2
SHA512 1450098853073b854e529977b1ffccb3bb75a8213f3610f4e0e88e0b357e3ddaea6cb1122e10927c3e3520bd3316d1eae5d6192810e91d60d95d1079769ce347
SSDEEP 12288:gxzh9hH5RVKTp0G+vbhr46CIcy0yZmGyYa:gph9hHzVKOpPc+mGyY
TLSH
T14ED4CF11B5E3C472D0B201B5490ADB3A9A7BB9504638A8737BE60FCE4E787D1FB17252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Opera\ucrtbase.dll
Size 1.1MB
SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 c4a25dce665733663284750666684703
SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
TLSH
T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3668_794159397\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

x00KeoA.7z

Path C:\Users\Admin\AppData\Local\Temp\x00KeoA.7z
Size 17KB
SHA256 5c67ee41d3f8910f2db83a816bbde6bd27c1227664450bf584a677e9bcf922a8
MD5 4d622f2573fb5ab9b21e497013fc3377
SHA1 d024cc94e7151ca09af95ab66679138e6742950b
SHA512 0989e546aa071f9af46865621ef66855fa333d9bca1a6d4296aaf993c96e22cb92521823c2c7bd919bb15d0fec2bac4b1e1b7367ef9f46dd9c60e8594cc6505a
SSDEEP 384:Ez8Gd6S92fv6xDJiwQKnsmMm9oUeZpXq3T0P0IuJtBAmW5Te9:py6Sw3cIYnsEoFuTu0PT2mW5Te9
TLSH
T13172D1950ADB706A34DC16D5ED2E8CCB521F5033985A4C19161CF6E12E723A4CBF346D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\cxjcm\D3DCompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\cxjcm\chrome_100_percent.pak
Size 123KB
SHA256 f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9
MD5 a59ea69d64bf4f748401dc5a46a65854
SHA1 111c4cc792991faf947a33386a5862e3205b0cff
SHA512 12a1d953df00b6464ecc132a6e5b9ec3b301c7b3cefe12cbcad27a496d2d218f89e2087dd01d293d37f29391937fcbad937f7d5cf2a6f303539883e2afe3dacd
SSDEEP 3072:YerKzw9bpxlr+bEfF2DGb0+VvfGGY304F2DExm/KLQ2I:YeKzw9Vh90Gb0OveGe04mExhLY
TLSH
T187C3D0D373F0ED7DCF6756B7A52A41B1ECB302391A92034A469AD8356A27348DDC8393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\cxjcm\chrome_200_percent.pak
Size 183KB
SHA256 7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b
MD5 1985b8fc603db4d83df72cfaeeac7c50
SHA1 5b02363de1c193827062bfa628261b1ec16bd8cf
SHA512 27e90dd18cbce0e27c70b395895ef60a8d2f2f3c3f2ca38f48b7ecf6b0d5e6fefbe88df7e7c98224222b34ff0fbd60268fdec17440f1055535a79002044c955b
SSDEEP 3072:yDfDQYaEM+9bslr+bEfEfRIGMR+F8fQnYw9pGbXGYoDd+qHqRxmeK/rIM0:6DQYaF+9bMhCWGMRe8InVXYopym74
TLSH
T12E04D1D7A3F49D3CDAB30A77553A01F1ECB6127516A3424A42DBAC347A5678C4CC9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Roaming\cxjcm\ffmpeg.dll
Size 2.7MB
SHA256 8653b57b37618f11e358c93aad9dc9ef0193f0288f7e59147194e42b0842b50e
MD5 b34d74a152e1788532b0acfa8cfbdf1e
SHA1 e99e5a26d8b695b57cb1a1bb0d2c032d822d0461
SHA512 06f8def21101d8c899c321b3a445e6838f824d6d6305d569b49fb7ad14a197a57c601a8965c50057e7af1d5414b74dd2c79e2f27a58eedab31b3b36202947dd9
SSDEEP 49152:nSFoiJBtTcoQ9mjUBA6vXH4VjB0kxryYTK8gJ2EDE+oM0iloSa08UHdiVqAy6cTC:ijUBA656ryEpEdiVq4
TLSH
T1DFD59D0BF2A645DDC029C53083AFA233F934394A4725A6EF16A156252F3FFD0667EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\cxjcm\icudtl.dat
Size 9.9MB
SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
MD5 70499b58dc18e7ee1d7452a1d7a8bc6e
SHA1 41c5382f08c6a88670ce73a20c0dcdb3822f19e9
SHA512 a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6
SSDEEP 196608:uUGwSv9AAQnt6liXUxR0rHa93WhlU6t7CLhl:uoKlQnAliXUxR0rHa93WhlU6t+Ln
TLSH
T131A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\cxjcm\locales\en-US.pak
Size 85KB
SHA256 ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b
MD5 6bbeeb72daebc3b0cbd9c39e820c87a9
SHA1 bd9ebec2d3fc03a2b27f128cf2660b33a3344f43
SHA512 66944fb1abcc2a7e08e5fd8a2cee53eb9da57653d7880aea226f25879e26379f7d745ebf62a3518378fa503f3a31b3ea3716f49fe4c7db4f4af0228b81b53a10
SSDEEP 1536:MzBh0wu6Y90fYSKD0R4RlQ2trhWMJ5dBxgMSO0JedMVrBHhQYVfD3ggl+C/fpkwG:6hp1YSwhBxgrvQY3ggl+CGwG
TLSH
T1BB835E1BE3C41266099243227F06E3B6AB26D079936311663C6CC16C3777FA982777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\cxjcm\resources.pak
Size 4.9MB
SHA256 367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df
MD5 5507bc28022b806ea7a3c3bc65a1c256
SHA1 9f8d3a56fef7374c46cd3557f73855d585692b54
SHA512 ae698d4feacc3e908981ee44df3a9d76e42a39bf083eaf099442ace2b863f882b43232e26e2c18051ca7aec81dccef5742acc7b82fb0cda2e14086b14d5a9a26
SSDEEP 98304:1jMQZikLH2tMPwSGBNumogFJlFlh1wTJntwyqWBsCiLeD8crwrb:tMqimHmGfgfhyTh8YsCi6Qckrb
TLSH
T1FB362302F2E4283BC6DB31766C6BA161B73444471068BD2E7A9D52DCAF5492802FEFF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Roaming\cxjcm\resources\app\index.js
Size 240KB
SHA256 176f28d4929e80b0039851d31297cc3db98cfc2813216ecda880d7dc63668618
MD5 54e9cc07b1bf0158f749a741a23921fa
SHA1 d811807a19ae6d733b9cd902e700f7d836862b77
SHA512 26204d6fe601cf916d30cf3f984a8ab272a422f3b5bc99c65fee7bc56a8302e0e45a98dcfa9165ef19286c3ea8cd89a377b250726dea3ab2e56b430b13f325d9
SSDEEP 3072:/hprLsKuviSpbMECceMtJmCC4j9X1aQllVO1V:/hprLs7viShChMtVC4j9FU7
TLSH
T1303495843BCAA0D2421935F1063F3615B56E4D627A0CCA88D7FAB49EFDB930594B7E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updateInfo.js.map

Path C:\Users\Admin\AppData\Roaming\cxjcm\resources\app\node_modules\builder-util-runtime\out\updateInfo.js.map
Size 68B
SHA256 7318ccc42e283138707b3e67f39f03753f5ba998ab0d4e5bbe28fc79bc4f28e4
MD5 8d7f8e1cbd902a2427246d4831e90812
SHA1 608ab180e80eec4ce60ecad7fbdbabc055820342
SHA512 b6b21a0956d75d56105fcd38af04fe95bea39401f968a93873282d46f0919fe36c8fa91a330b08d91ed71927b35ae6830bea07dcad5a0fe4f5b75dd9e5a6b028
TLSH
T1F5A0028B58706F711F1007A908551FC272E1905AD80D405CD8D58C88573C01E4DD5C13
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Roaming\cxjcm\resources\app\node_modules\cacheable-request\node_modules\get-stream\license
Size 1KB
SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
MD5 d5f2a6dd0192dcc7c833e50bb9017337
SHA1 80674912e3033be358331910ba27d5812369c2fc
SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
TLSH
T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\cxjcm\resources\app\node_modules\clone-response\LICENSE
Size 1KB
SHA256 861908ec818ff6142fdd6c4b66d6264c206d3d5a46003b1342e1853a9a85abac
MD5 9a2baa6947d5018096b83508bd94026e
SHA1 cbe9761d4d16ad1a0a2007b305bc2951bf94be98
SHA512 6fea6e2f30885cdd6cae236637ef194fe9eb06276437e370c02eac651e170031980ab201ff5e8a95b7b5c21f24788fa93807d6c4f2cf79d5f71792e6e8a61fef
TLSH
T10C11421E72510B76189A13A05579A8D9B22BB25ABAAF2A84146EF245232A06CD5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\cxjcm\resources\app\node_modules\defer-to-connect\LICENSE
Size 1KB
SHA256 0194571d45a06ea2a22ceb51f981e3be92525966d28847dbc0d9982603bf90de
MD5 78fd36a7284eb85369521bcb6e863186
SHA1 8ab3afa5af90b0fa4421252da279bf563b3c47b9
SHA512 265c0b9cb7e34ea63851a6bf0da02cd3da5beb2839b79bdec72607b26a5aeb0f34a812f37941d77c692f9f9799a706de704f41c9e0f360b8d40dbb9d0b416481
TLSH
T15511755EB251077228AB13A05578ACD5F23BB25F7A6F2A84246DF345233A06CD5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Roaming\cxjcm\resources\app\node_modules\is-svg\license
Size 1KB
SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
MD5 915042b5df33c31a6db2b37eadaa00e3
SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
TLSH
T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

pako_inflate.js

Path C:\Users\Admin\AppData\Roaming\cxjcm\resources\app\node_modules\pako\dist\pako_inflate.js
Size 106KB
SHA256 ec7e5936c652800e132c63cc1fcd00c23103a6a10a294ed3736bab70e38fc592
MD5 18ba5b8f0f9d69b8443df838577b59c7
SHA1 f21e39c5004036d69c56ad7b0f81607d9687714f
SHA512 98eb3873b102823c64154922bc5bb60107a8e78de7ec8e0d7a9b0d332be23fc6c8eb456640e5513f193a7d92f33ddd0092bb0688e3ee29ea19a3516b5fc2bdac
SSDEEP 1536:VWiXPnKsErlxSelzMs7GfJUVuNhaScFDYRe:fs6ON7E/a7x
TLSH
T104B3F84526F3221B181660B5DB8F70A567E6911F430BD9643CAE83847F9063E82FDFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\cxjcm\resources\app\node_modules\pump\LICENSE
Size 1KB
SHA256 3fe8d55a98dbf260eace67c00cf9bc53edb46234e840098a0b93df3096b97fb6
MD5 9befe7026bf915886cd566a98117c80e
SHA1 a95ab3a4b0e4bd978897f09b3b430a449da20a08
SHA512 b52ba143042812d6dd1031a12946afddb6e8f8ebbc7169c59c138d16aafc5e261aae92fe6b1ea94a3d80e39d2415c4b219710ef46939a2df135db24a0cf712fb
TLSH
T14E11B91E735507761CAA13605579ACD9F12BB25F7A6F1A44146DF340133A06CD1FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\cxjcm\resources\app\node_modules\semver\LICENSE
Size 765B
SHA256 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
MD5 82703a69f6d7411dde679954c2fd9dca
SHA1 bb408e929caeb1731945b2ba54bc337edb87cc66
SHA512 3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46
TLSH
T1E401FD9FB2E26BD458D09B603DA16DC962CAB03B7803AA152468E298DB7740FA47A400
MD5 SHA1 SHA512 TLSH

Submit Download

angular-sprintf.min.map

Path C:\Users\Admin\AppData\Roaming\cxjcm\resources\app\node_modules\sprintf-js\dist\angular-sprintf.min.map
Size 429B
SHA256 3d6885b5d3ebce0c1119d558c8784806cc79f076a5af8279051b7e94c412b697
MD5 88110c6656f210b1a33dfbacaca20bc8
SHA1 7e346bf1faac9cf2a443b934627d644c4a2a1e1e
SHA512 580fff2450e6afcf8be2d46fb46babfa89c157488cac31b322de78869ec3027067d345360cbf5a63b77a008f5213a608677263a507102e580f067a173a67d417
TLSH
T102E0E5F4CCC96D1869394DD9E4990E4C2BCEC09A7EDDF3114A94C56C4421F0DF0A0430
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Roaming\cxjcm\resources\app\package.json
Size 326B
SHA256 ed559a3a3027667ce6302f1debaed9aef5bef1c6d4236ec4da01199b398f78b2
MD5 48f234e36eba960bf0f66519a219e17e
SHA1 988d574c95e613f177e81417c590540f77ed9845
SHA512 08ac57c789dd209ceebdc73d5ee709ee141811f0955b982454c3459eeac9353eec08aac68646d18c55a181a1f5f64f56fcbebe203597dabef54f2deb40e5e276
TLSH
T128E08C18DC499E23129B888A3068014728612C079959F80DB79E930C1E5C96FB2FCAAD
MD5 SHA1 SHA512 TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Roaming\cxjcm\swiftshader\libegl.dll
Size 458KB
SHA256 bfd1d3fb9e50a3d9a58d9c62663fbf46bedcac24744020b801c9bb4cdc55f977
MD5 21a07ee229edc5d8de61de97f1a65210
SHA1 a60f93adbad349e25cca0eca5a81c78fbf24f133
SHA512 6375d8bda8cc187f79f6ea0cfd8358ac0d85508327f44d0bbcca641a934fa2b690933eb1ab588821a2f63f6615b1926aa433bc759b787015170aff11e633d0e4
SSDEEP 6144:e6txlbRay7iVeTIM4gkZ8A9YfCmpmXZvrpeK8MbhGG+gwLuggcAgAeG4:ePZ4IM4u7BmXZXGuTcAD
TLSH
T13CA47C16B7A504A9D036C4348A574A43DA71B8DA0F74EBEF0294A27D2F7B7E05F39324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Roaming\cxjcm\swiftshader\libglesv2.dll
Size 3.1MB
SHA256 54b6e787450bfcebed843ad1dafb31ca0904a908131d1005b567513ee8e2db46
MD5 07a0f70d8e06fcb7e9063f39c0ab8c68
SHA1 896f3401b019c31ab1de2a376a66829daceccadb
SHA512 f58e4b23eca4aa4eef435288fc4d3740ea700debe82e083167a68df709c383f8bb7393ee74558acae8804ed105536ac86c5657912a98d284a1fc57dcf25586ff
SSDEEP 49152:cgnhCIFndJN3alVO7hUADGoJJ5AtyPzaaujA84dvCilHS4E0JhHHRBHpJbftopLw:TYIFnXoLfauC1DeFR
TLSH
T1EFE55A43E08880D9E05DD5BC874BA62EE132BC856B7272DF12946B222E77BF0573DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\cxjcm\v8_context_snapshot.bin
Size 160KB
SHA256 31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790
MD5 b64c1fc7d75234994012c86dc5af10a6
SHA1 d0d562b5735d28381d59d0d86078ff6b493a678e
SHA512 6218fcb74ef715030a2dd718c87b32f41e976dd4ce459c54a45341ee0f5ca5c927ad507d3afcffe7298b989e969885ed7fb72030ea59387609e8bd5c4b8eb60a
SSDEEP 3072:pBgpuz1xV9mRTUAnPH5lZw15qCy0CmiRNiA0hTBAzZs7q/JBXTPv:p4O1xoTPyqIRhTBAzZs7kJ1TPv
TLSH
T1F2F3121427D0829096ED4094A25B06E7C5D26C6D1E2CFF0A3BB5FD4C0AA3DCE55FE1B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daemon.log

Path C:\Users\Admin\AppData\Roaming\daemon.log
Size 8B
SHA256 1ed04c4d0c34dbcb7acdb642b36e76bdf7b29d1a6ccead5f68d6bcfeb299e916
MD5 592290f4c6a1aad9dc3b3ac1fb4f4959
SHA1 2f57fc504da39b8ad70ecbe59245093e1d23d952
SHA512 787ec094143f0da430a15fed17c24de05a4161f0ee822971c200e754b8e71ef575209a25ccf93839e514886ba4c60b4ca732d1038871e74503a7e9831418a5a3
MD5 SHA1 SHA512

Submit Download

e59a36a.msi

Path C:\Windows\Installer\e59a36a.msi
Size 6.7MB
SHA256 bfa315c6c37f5bac2c5959d4e606d11ca1ae1a46e09b107e16983709e08538b3
MD5 cfca53ca1e4f8d8138093a35dff51cd1
SHA1 7291c516ff7cb309ff4db7636f1a0b575a03354e
SHA512 6074c04b5c343a9ab46bdbfa40cb843ca301272d9081ec8282c0c1e58f1019f1fb3b9384b3b8bcfaf0ad5b4d460b9c5b2ac3a8f73353487eba0561c340fc7e84
SSDEEP 196608:1XpOfy4WUFUqXtW0wKm1TqxkIQ70t0aIoHH:1X2fq+E9Km1Tqxkf0tJ
TLSH
T12E66338CF53AAA53D1C9FB399DCD46906FF99E439FA1181E3580B6E409F81E1318E4C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 92e94b01c044870e726ccbbfe9dd7be6870d28fd9afcbc3d7bda504fdb4bd4e1
MD5 0968a9c10247c9a70ba5372c6729f9d8
SHA1 b6af3f82551fc7880bca7cdb36afb6d952d0c0a5
SHA512 e13b14788f412d06cdf4000b1d82ff0d495b42d25108bde03fd853c02b9a17d267f32d9a4edd78041706eeff7a924fd3ea2355853b5d8e2b7089c3e6042e79f0
SSDEEP 24576:oFo3DMP1doO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+z:0HI
TLSH
T18757B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7fb813db-69a1-4bbe-a4e5-2b138b6a3a7b}_OnDiskSnapshotProp

Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7fb813db-69a1-4bbe-a4e5-2b138b6a3a7b}_OnDiskSnapshotProp
Size 6KB
SHA256 885392a58a8b8bc44d22184a045a2fd4f99ca559b5a652794cba273e98a59fc2
MD5 8cf10bf484c53a089bf2e47ce67a9d97
SHA1 649ddba09726bc3d37cd2fba442c1fbf01e39f19
SHA512 931f59719f281fcec885dfcb322560b71328ac12ea08496e718790f97c68d0466a0b7faae1c6e81ec20aedf6790d1a2fc4e11c7be1543a14dd338df4372adb8a
SSDEEP 96:Fe9ICbmvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:M9I3b++uVmN
TLSH
T138D178085AF54711E2B3AB3228F14557A837B911FF33CB8E0298238E6671910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2104-1938-0x00007FF883C00000-0x00007FF883C01000-memory.dmp

Download

memory/3676-53-0x00007FF884FA0000-0x00007FF885203000-memory.dmp

Download

memory/3676-41-0x0000000000B30000-0x0000000000BCE000-memory.dmp

Download

memory/3676-47-0x0000000000BD0000-0x0000000000E0D000-memory.dmp

Download

memory/3676-52-0x00000000753F0000-0x00000000754E5000-memory.dmp

Download

memory/4888-77-0x00007FF884FA0000-0x00007FF885203000-memory.dmp

Download

memory/4888-76-0x00000000753F0000-0x00000000754E5000-memory.dmp

Download

memory/4888-70-0x0000000000AA0000-0x0000000000CDD000-memory.dmp

Download

memory/4888-2377-0x0000000074140000-0x0000000074A5C000-memory.dmp

Download

memory/4888-66-0x0000000000A00000-0x0000000000A9E000-memory.dmp

Download

memory/4888-83-0x0000000074140000-0x0000000074A5C000-memory.dmp

Download

memory/4888-79-0x00000000753F0000-0x00000000754E5000-memory.dmp

Download

memory/4888-82-0x00000000753F0000-0x00000000754E5000-memory.dmp

Download

memory/4888-1974-0x0000000074140000-0x0000000074A5C000-memory.dmp

Download

memory/4888-89-0x0000000074140000-0x0000000074A5C000-memory.dmp

Download

memory/4888-1927-0x0000000074140000-0x0000000074A5C000-memory.dmp

Download

memory/4888-105-0x0000000074140000-0x0000000074A5C000-memory.dmp

Download

memory/4888-2466-0x0000000074140000-0x0000000074A5C000-memory.dmp

Download