Overview

overview

8

Static

static

3

nitroTypeI...er.exe

windows10-2004-x64

7

nitroTypeI...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    432s
  • max time network
    555s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 22:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    nitroTypeInstaller.exe
  • Size 25.8MB
  • Sample260824-2vtcfazxex
  • SHA256 294c947506df264b5471961fdfb25b15f78a9c5e7bf3108aba230c6e236e793e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryinstallerpersistencespywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 24 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\nitroTypeInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\nitroTypeInstaller.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:6080
    • C:\Users\Admin\AppData\Local\Temp\is-ISTHVY1YYV.tmp\nitroTypeInstaller.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ISTHVY1YYV.tmp\nitroTypeInstaller.tmp" /SL5="$5003E,25953419,882176,C:\Users\Admin\AppData\Local\Temp\nitroTypeInstaller.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4248
      • C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe
        "C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious use of WriteProcessMemory
        PID:4276
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --embedded-browser-webview-enable-extension --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4276.1604.5712654833208874712 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
          4⤵
          • Drops file in Windows directory
          • System Network Configuration Discovery: Internet Connection Discovery
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          PID:3896
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x108,0x7ff806405fd8,0x7ff806405fe4,0x7ff806405ff0
            5⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4536
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1892 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
            5⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:5888
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2100 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
            5⤵
              PID:4228
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2340 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:3176
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3360 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05 /prefetch:1
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2416
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3844 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05 /prefetch:2
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:1000
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4516 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05 /prefetch:1
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2616
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4504 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05 /prefetch:1
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:1920
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5232 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05 /prefetch:1
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:3156
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5016 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:5688
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5372 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:5996
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5384 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2940
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5304 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:4528
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5532 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3744
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5548 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:5144
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4592 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:1316
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5652 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:1868
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5660 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:4004
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5704 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:1316
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5784 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2812
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5972 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2556
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5936 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:4616
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5992 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05 /prefetch:1
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2908
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView" --webview-exe-name=NitroType3.exe --webview-exe-version=1.0.0+c927a3fd6eb4e6f33c1aaa536550f23b2921ca47 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5988 --field-trial-handle=1896,i,6740668808921927705,2854788833910806014,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:9802d4b18073b72130823693995ec08c82c99e05 /prefetch:1
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:4256
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:1116
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:2144
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:4084
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2696
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4904

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 595B
            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft.Web.WebView2.Core.dll
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\Microsoft.Web.WebView2.Core.dll
            • Size 557KB
            • SHA256 11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Web.WebView2.WinForms.dll
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\Microsoft.Web.WebView2.WinForms.dll
            • Size 37KB
            • SHA256 5696366f7458da940cc986dc5d3d4549a2368512acd769014ecbb07b47bd88b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NitroType3.deps.json
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.deps.json
            • Size 1KB
            • SHA256 823f4a5977439eb3ebd59fc91363bf782ee64fbfc98851cc5de319696b382901
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            NitroType3.dll
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.dll
            • Size 54KB
            • SHA256 19361a11c0b24177d6c9dc5eb6a24ab1e8d882657f45a31e8ec0a940089c0b8e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NitroType3.dll.config
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.dll.config
            • Size 1KB
            • SHA256 73fb38fc8fcbdfd84dfb798844f8df75a7f2a27ae1da8b9bd0bc002076a9b081
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            NitroType3.exe
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe
            • Size 148KB
            • SHA256 ba45245aafbe3deb41a93799e06bc548a21c2f9e3284dd3e41113c33bac45b11
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Crashpad\settings.dat
            • Size 280B
            • SHA256 189b18d30631636afbef8d317438989d9ca5513cb4ad9b907b3c8cb7f097c691
            • MD5 SHA1 SHA512
            Submit Download

            settings.dat
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Crashpad\settings.dat
            • Size 280B
            • SHA256 9fa1cbe6fcd5faee8c909e95950e282af5524fd7a6c45bce5874fb4f9d9738cf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            throttle_store.dat
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
            • Size 20B
            • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
            • MD5 SHA1 SHA512
            Submit Download

            f_000002
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000002
            • Size 124KB
            • SHA256 b3e1d75c38b8b5b5bf9178c095d5274ba95ec99a2f3ed93b38b2d5f315b72619
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000021
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000021
            • Size 66KB
            • SHA256 51116c3e7136438da6e0b4b3949b6ddfd3ef21ce820a28e59381d17df3731e78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000022
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000022
            • Size 722KB
            • SHA256 f47a8e0692e6fa217d34408484342f381835987aa6f38ebd09ac81447e6187de
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000023
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000023
            • Size 51KB
            • SHA256 18cd8c7f9cd0acfe1456e18ea0096bca67a285225b945fffcadd7ec4be9e84c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000025
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000025
            • Size 87KB
            • SHA256 0d195aee1f2e4483ade034d0e983041b259b9e9a2e801460ee5bdcdea927eb81
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000027
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000027
            • Size 17KB
            • SHA256 84fb12632812ff8c3a508c35d592b59bf0cd9557462bf656265b5f473bf9eb66
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000028
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000028
            • Size 17KB
            • SHA256 74a4ff8af4455a19bf187d3e89d635fccabfe9d39f2aec2d75f7d3cc3c38b2df
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000029
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000029
            • Size 243KB
            • SHA256 238151a82323feaf2a7649524e269d61a09e0dba175045889198367ddef9580e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_00002a
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_00002a
            • Size 261KB
            • SHA256 e77d46ea766318f4e7ed6c4e49efc3cbbe99a317d38ac978b487e2189bdafa9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000031
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000031
            • Size 17KB
            • SHA256 f33cb760be5e8a2ca6526d0c3b15e7eb1128f357e8cc0d8d99218c980ceff5ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000032
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000032
            • Size 51KB
            • SHA256 b83053dec2e3d65fb1690f954715575c9573bbaf1fe009f655e1ae46040c38d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_000039
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000039
            • Size 255KB
            • SHA256 0e47b283e8df9f8e44ccc9258f6fd541941bc082290f3d40a1a0e4ad5a10e2bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_00003a
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_00003a
            • Size 135KB
            • SHA256 73957be281c6c106ded7dc8e7703b916f8fdcd33125f7220847c57b0acd2fdff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_00003b
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_00003b
            • Size 166KB
            • SHA256 676818b2f65fe9e3897da39ec016307f84811bedcdf069f66f26541854ea8ec9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
            • Size 360B
            • SHA256 2da63392e642b5c74b4cca22ceaae6594417df413017359b0485194bda3cc371
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index~RFe5b3390.TMP
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5b3390.TMP
            • Size 48B
            • SHA256 3bbea6e86ec6230a665fcac03fae18e3a64830dc7eda14768e5c94c8ce8165a3
            • MD5 SHA1 SHA512
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Extension Scripts\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\Network Persistent State
            • Size 3KB
            • SHA256 260c3aa0c8b4b78c90faaa83fd9cfc25107db53b61b14d7c0f78c29304924d7b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\Network Persistent State
            • Size 2KB
            • SHA256 dc9ae80d55ae6b1e9ff0bbaacde4c41867b84897bf140f327fcc1ade26812e63
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\Network Persistent State
            • Size 3KB
            • SHA256 de1896e98f2d352706fc16ca271f23883f4466f60f071df6b54956920ea6bafa
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\Network Persistent State
            • Size 2KB
            • SHA256 77dd2a169325a0d6c89665f2537ff65574efc4d60a22d49704b5db72886bf637
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State~RFe5b4795.TMP
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5b4795.TMP
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\TransportSecurity
            • Size 689B
            • SHA256 0d61a3145fdc5cba0952e52bd96f644efc52a4d342f8b5523cc60f5ff9902916
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\TransportSecurity
            • Size 188B
            • SHA256 cecfa69e094c3f5f6098a048123c488acb9c0e32e168d976c6a67737709c246f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\TransportSecurity
            • Size 689B
            • SHA256 4775331a1ba08ae9a380520604911d87a6b998b66a17c8ce8939cf00f631a2db
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\TransportSecurity
            • Size 689B
            • SHA256 b47d44cf1b6e83daa831a13155cef0c182c83899d2cc5c808e7b42edd575899d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\TransportSecurity
            • Size 689B
            • SHA256 eca1be9721d66db0ccc07b793a0bf17bbe8ca75508ee77cb30ce0c239c53c3cb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\TransportSecurity
            • Size 689B
            • SHA256 ece63667271131b592ea660da72094c654d670fc1220473b09b70b6419e1b956
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity~RFe5a8b2a.TMP
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Network\TransportSecurity~RFe5a8b2a.TMP
            • Size 188B
            • SHA256 f3463638d33cd10259bb20b6fb22aca7de3353b2b39f701d47bd6f9a8f64d5a8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Preferences
            • Size 6KB
            • SHA256 19e5cdfed3ba416ed647fc917c1b20e63b60cfb81da602ac94d80506573d5ddb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Preferences
            • Size 6KB
            • SHA256 ff1eb4d36877d31e9f69cec975813919e93160181716bae345b61e97ce07a291
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Preferences
            • Size 6KB
            • SHA256 ac733448b5e3cc592706a26a243c8a47f2e2fdc95692cabe0a2f4a1bcdbdba00
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Preferences
            • Size 6KB
            • SHA256 7df3a6f92146bede9fa54657b75dd133e199c28055108922b191db4a125fb213
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences~RFe5a8ca1.TMP
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Preferences~RFe5a8ca1.TMP
            • Size 6KB
            • SHA256 b1cb940cf44ede54133bfe19a6a9799e4f9bfcd4ba378e0b643d58158a7da7f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
            • Size 72B
            • SHA256 d09e30a655d0c171bc3584f04d0a19d04da4b9b6b805009ec52ece2930083aed
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index~RFe5a84c2.TMP
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a84c2.TMP
            • Size 48B
            • SHA256 91a0227fff4a440d90dc816f01ccf3256d5790285783f69c1792c2e31720a42a
            • MD5 SHA1 SHA512
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
            • Size 264KB
            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Local State
            • Size 3KB
            • SHA256 4208f6d4bfd97c2e46795822809bd9624e1ac9b2b2aedaa0812fba161a5191f5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Local State
            • Size 15KB
            • SHA256 a0d8f007512783d4c7c702e0760ddd1202d251bce50eb376954df72684d2569e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Local State
            • Size 2KB
            • SHA256 dcf56369d82ae0d193d78fb37940c9a3351467655f56fbfba6c16eb8361b7ecb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Local State
            • Size 15KB
            • SHA256 7f89cd0f77b42fbba8fb10fca7d9286d1dc1ceb7f774a9c456fba54b8b4cb520
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State~RFe5a323d.TMP
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.exe.WebView2\EBWebView\Local State~RFe5a323d.TMP
            • Size 1KB
            • SHA256 23c61b05d43a2973fba8efbf372b6461f7ddf3df253c14e42edf17bc182e2f29
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            NitroType3.runtimeconfig.json
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\NitroType3.runtimeconfig.json
            • Size 515B
            • SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            messages.json
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\extensions\hlifkpholllijblknnmbfagnkjneagid\_locales\en\messages.json
            • Size 1KB
            • SHA256 84708caea63752113e8fa9f9edc502abfdd787de8c33f08a4eb620b91a5a1144
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            _ruleset1
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\extensions\hlifkpholllijblknnmbfagnkjneagid\_metadata\generated_indexed_rulesets\_ruleset1
            • Size 603B
            • SHA256 5d4a38ec5fffc1304f62ba3496bde6db228f54a51d689de2244af16b399d5fcd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            verified_contents.json
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\extensions\hlifkpholllijblknnmbfagnkjneagid\_metadata\verified_contents.json
            • Size 8KB
            • SHA256 e16c7f4b7c5ea8cf87f65599cc05559521ac01371b4653a8822215d086d74e15
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            background.js
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\extensions\hlifkpholllijblknnmbfagnkjneagid\background.js
            • Size 29KB
            • SHA256 2c6d010e1d41f315c0c4654f8905984bda3d064b72eaab8bdbd1b9eee8c8ab8e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            captchaDetector.js
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\extensions\hlifkpholllijblknnmbfagnkjneagid\content\captchaDetector.js
            • Size 954KB
            • SHA256 3743ea2abbed8b51acbd5e39cdc5e1c4ffc7b3eda8fcc1a0d31fc979c318c52a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            clientIndex.css
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\extensions\hlifkpholllijblknnmbfagnkjneagid\content\clientIndex.css
            • Size 7KB
            • SHA256 4a7c92296372e93ffaa3bab6d8ec29348552c9cf3cf5475c2c55c2f542d8c535
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            clientIndex.js
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\extensions\hlifkpholllijblknnmbfagnkjneagid\content\clientIndex.js
            • Size 1.6MB
            • SHA256 4476b89d91e0a154becb17e046534bc0883700f23724e4640020967a4a85c765
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            manifest.json
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\extensions\hlifkpholllijblknnmbfagnkjneagid\manifest.json
            • Size 2KB
            • SHA256 a376b3d6a550107c4e64a508c7a59a4e82e17c9e9fdd6e9835f324a4bae2c9d9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            cs_logo-128.png
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\extensions\hlifkpholllijblknnmbfagnkjneagid\static\icons\cs_logo-128.png
            • Size 9KB
            • SHA256 577b0607a45c1e90793adfcb0811ecad8f728d6986314f436889ead62f5f1cb5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cs_logo-16.png
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\extensions\hlifkpholllijblknnmbfagnkjneagid\static\icons\cs_logo-16.png
            • Size 1KB
            • SHA256 2197d0a5930aeeeef2f487e9445512298e4a3acd94f6107c456a5105098a514f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            cs_logo-48.png
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\extensions\hlifkpholllijblknnmbfagnkjneagid\static\icons\cs_logo-48.png
            • Size 3KB
            • SHA256 02bfbfef9ff6f6c0d4eddc3ce435ba852a64024025b951fb91f00e5e705598f7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            rules.json
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\extensions\hlifkpholllijblknnmbfagnkjneagid\static\rules.json
            • Size 551B
            • SHA256 a9249c5c9b6b86494750b725dbd5246f5a1f3c068e9cdc99b9980b3cbd6b79c4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            WebView2Loader.dll
            • Path C:\Users\Admin\AppData\Local\Programs\NitroTypeAutoTypingApplication\runtimes\win-x64\native\WebView2Loader.dll
            • Size 161KB
            • SHA256 465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nitroTypeInstaller.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-ISTHVY1YYV.tmp\nitroTypeInstaller.tmp
            • Size 3.6MB
            • SHA256 9d216492fbba7ff3263dda8b7f4ec583a83533d3d0c564aec34aca74a80e9f8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NitroType AutoTyper.lnk
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NitroType AutoTyper.lnk
            • Size 1KB
            • SHA256 ff27ee40cc2c1f2f776a4da6bf16610d62203d026b8849d72fe909148878868b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Log-24-08-2026.log
            • Path C:\Users\Admin\AppData\Roaming\NTH5\Logs\Log-24-08-2026.log
            • Size 4KB
            • SHA256 e9ea0f5539fd9a90d14bc0b769fb6aed2ff26ce0f63dd4b95e780dc7e48c13d4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-bn.hyb
            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_344265724\hyph-bn.hyb
            • Size 703B
            • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hyph-mr.hyb
            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_344265724\hyph-mr.hyb
            • Size 687B
            • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hyph-nn.hyb
            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_344265724\hyph-nn.hyb
            • Size 141KB
            • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1000-429-0x00000230D3620000-0x00000230D36F6000-memory.dmp
            Download

            memory/1920-549-0x00000266A6AD0000-0x00000266A6BA6000-memory.dmp
            Download

            memory/2416-267-0x00007FF82A8A0000-0x00007FF82A8A1000-memory.dmp
            Download

            memory/2416-428-0x000001F638440000-0x000001F638516000-memory.dmp
            Download

            memory/2616-530-0x000002380C350000-0x000002380C426000-memory.dmp
            Download

            memory/2696-1626-0x000001F3AD5C0000-0x000001F3ADC51000-memory.dmp
            Download

            memory/2696-1701-0x000001F3AD5C0000-0x000001F3ADC51000-memory.dmp
            Download

            memory/3156-550-0x0000022F89E30000-0x0000022F89F06000-memory.dmp
            Download

            memory/3744-783-0x000001A36BA10000-0x000001A36BA11000-memory.dmp
            Download

            memory/3744-780-0x000001A36BA10000-0x000001A36BA11000-memory.dmp
            Download

            memory/3744-779-0x000001A36BA10000-0x000001A36BA11000-memory.dmp
            Download

            memory/3744-781-0x000001A36BA10000-0x000001A36BA11000-memory.dmp
            Download

            memory/3744-782-0x000001A36BA10000-0x000001A36BA11000-memory.dmp
            Download

            memory/3744-784-0x000001A36BA10000-0x000001A36BA11000-memory.dmp
            Download

            memory/3744-775-0x000001A36BA10000-0x000001A36BA11000-memory.dmp
            Download

            memory/3744-773-0x000001A36BA10000-0x000001A36BA11000-memory.dmp
            Download

            memory/4248-6-0x0000000000D90000-0x0000000000D91000-memory.dmp
            Download

            memory/4248-10-0x0000000000D90000-0x0000000000D91000-memory.dmp
            Download

            memory/4248-9-0x0000000000E00000-0x00000000011AA000-memory.dmp
            Download

            memory/4248-12-0x0000000000E00000-0x00000000011AA000-memory.dmp
            Download

            memory/4248-146-0x0000000000E00000-0x00000000011AA000-memory.dmp
            Download

            memory/4904-1545-0x0000021604550000-0x0000021604570000-memory.dmp
            Download

            memory/4904-1559-0x0000021604A20000-0x0000021604A40000-memory.dmp
            Download

            memory/4904-1491-0x00000216001E0000-0x00000216002E0000-memory.dmp
            Download

            memory/4904-1543-0x00000216043B0000-0x00000216043D0000-memory.dmp
            Download

            memory/4904-1544-0x00000216047E0000-0x00000216048E0000-memory.dmp
            Download

            memory/5888-186-0x00007FF82A8A0000-0x00007FF82A8A1000-memory.dmp
            Download

            memory/5888-427-0x000002069F160000-0x000002069F236000-memory.dmp
            Download

            memory/5996-669-0x00007FF82C000000-0x00007FF82C001000-memory.dmp
            Download

            memory/5996-670-0x00007FF82C040000-0x00007FF82C041000-memory.dmp
            Download

            memory/6080-147-0x0000000000650000-0x0000000000737000-memory.dmp
            Download

            memory/6080-8-0x0000000000650000-0x0000000000737000-memory.dmp
            Download

            memory/6080-0-0x0000000000650000-0x0000000000737000-memory.dmp
            Download