hijackloader | eb24fcf88b060573af06bcc5facd2d08894966b625cf42e0fa15da22a5acdaa2

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_2e77891af9e7a72fb59ca4e74a00b670_elex_wannacry.exe
Size 12.7MB
Sample260903-rmgcssak5x
SHA256 eb24fcf88b060573af06bcc5facd2d08894966b625cf42e0fa15da22a5acdaa2
MD5 2e77891af9e7a72fb59ca4e74a00b670
SHA1 9bec74e34ca092c16b9c4c2b4c5ab754a85c05dd
SHA512 433de304d8a3842abe335ea88e6d38f4c52a719ec9015abbe9b127b276812bbe64886ce2aa30017c6266c947d32e4f1a5867c688b93c9e712ef62e0f405e1e88
SSDEEP 196608:+ps3WdBhkJqoYux2yjaMd9UvDAoMK6ZG+rUZcQj4rOd5OFYKg5RipuDjcY/JNaZI:+ps3wPkfgwd9UvAP4fj4yYF4TaZW/rP
TLSH
T14DD63340B789BAF5D02A5B728B12CF653533FF97AD110F97458B1C489F933A1AA0B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

5b0b21ab0f10edc736d445bb9ea3a4df credential_access discovery hijackloader vidar loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\ms_ctrl_v1_0
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

vidar

Version

Botnet

5b0b21ab0f10edc736d445bb9ea3a4df

https://62.238.125.238
https://t.me/nag0a
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=EMqJL

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:34.0) Gecko/20100101 Firefox/34.0

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024393-45.dat	family_hijackloader
behavioral1/files/0x000800000001ec17-123.dat	family_hijackloader

Detects Windows executables referencing non-Windows User-Agents 5 IoCs

resource	yara_rule
behavioral1/memory/468-206-0x00007FF6B92F0000-0x00007FF6B9580000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/468-466-0x00007FF6B92F0000-0x00007FF6B9580000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/468-484-0x00007FF6B92F0000-0x00007FF6B9580000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/468-515-0x00007FF6B92F0000-0x00007FF6B9580000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/468-523-0x00007FF6B92F0000-0x00007FF6B9580000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	2026-09-01_2e77891af9e7a72fb59ca4e74a00b670_elex_wannacry.exe

Executes dropped EXE 3 IoCs

pid	Process
4828	ITransponder.exe
4820	ITransponder.exe
2364	SonicReflector.exe

Loads dropped DLL 22 IoCs

pid	Process
4828	ITransponder.exe
4828	ITransponder.exe
4828	ITransponder.exe
4828	ITransponder.exe
4828	ITransponder.exe
4828	ITransponder.exe
4820	ITransponder.exe
4820	ITransponder.exe
4820	ITransponder.exe
4820	ITransponder.exe
4820	ITransponder.exe
4820	ITransponder.exe
2364	SonicReflector.exe
2364	SonicReflector.exe
2364	SonicReflector.exe
2364	SonicReflector.exe
2364	SonicReflector.exe
2364	SonicReflector.exe
2704	BManager64.exe
468	ThreEngine32.exe
3740	memu.exe
3984	memu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2364 set thread context of 2704	2364	SonicReflector.exe	105
PID 4820 set thread context of 468	4820	ITransponder.exe	107
PID 2364 set thread context of 3740	2364	SonicReflector.exe	109
PID 4820 set thread context of 3984	4820	ITransponder.exe	110
PID 2704 set thread context of 1548	2704	BManager64.exe	115
PID 2704 set thread context of 5768	2704	BManager64.exe	137
PID 2704 set thread context of 1548	2704	BManager64.exe	115
PID 2704 set thread context of 1600	2704	BManager64.exe	144

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	BManager64.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppCore\Location\Shifter\Relicensing Statement.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	BManager64.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketchAppService\ReadMe.txt	BManager64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	BManager64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	BManager64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	BManager64.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt	BManager64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	BManager64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	BManager64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	BManager64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	BManager64.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Third Party Notices.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	BManager64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	BManager64.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	BManager64.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\dbghost_arm64.job	memu.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BManager64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_2e77891af9e7a72fb59ca4e74a00b670_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITransponder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITransponder.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2164	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329188022888741"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2704	BManager64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4828	ITransponder.exe
4820	ITransponder.exe
4820	ITransponder.exe
2364	SonicReflector.exe
4820	ITransponder.exe
4820	ITransponder.exe
2364	SonicReflector.exe
2364	SonicReflector.exe
2364	SonicReflector.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
3740	memu.exe
3740	memu.exe
3740	memu.exe
3740	memu.exe
3740	memu.exe
3740	memu.exe
3740	memu.exe
3740	memu.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
468	ThreEngine32.exe
468	ThreEngine32.exe
468	ThreEngine32.exe
468	ThreEngine32.exe
468	ThreEngine32.exe
468	ThreEngine32.exe
2704	BManager64.exe
2704	BManager64.exe
1548	chrome.exe
1548	chrome.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
3984	memu.exe
3984	memu.exe
3984	memu.exe
3984	memu.exe
3984	memu.exe
3984	memu.exe
3984	memu.exe
3984	memu.exe
3984	memu.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe
2704	BManager64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2704	BManager64.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2364	SonicReflector.exe
4820	ITransponder.exe
2364	SonicReflector.exe
4820	ITransponder.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeShutdownPrivilege	1548	chrome.exe
Token: SeCreatePagefilePrivilege	1548	chrome.exe
Token: SeDebugPrivilege	2704	BManager64.exe
Token: SeShutdownPrivilege	1548	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4828	4652	2026-09-01_2e77891af9e7a72fb59ca4e74a00b670_elex_wannacry.exe	84
PID 4828 wrote to memory of 4820	4828	ITransponder.exe	89
PID 4820 wrote to memory of 2364	4820	ITransponder.exe	104
PID 2364 wrote to memory of 2704	2364	SonicReflector.exe	105
PID 2364 wrote to memory of 2704	2364	SonicReflector.exe	105
PID 4820 wrote to memory of 468	4820	ITransponder.exe	107
PID 4820 wrote to memory of 468	4820	ITransponder.exe	107
PID 2364 wrote to memory of 3740	2364	SonicReflector.exe	109
PID 4820 wrote to memory of 3984	4820	ITransponder.exe	110
PID 2364 wrote to memory of 3740	2364	SonicReflector.exe	109
PID 4820 wrote to memory of 3984	4820	ITransponder.exe	110
PID 1548 wrote to memory of 2060	1548	chrome.exe	118
PID 1548 wrote to memory of 984	1548	chrome.exe	119
PID 1548 wrote to memory of 984	1548	chrome.exe	119
PID 1548 wrote to memory of 2164	1548	chrome.exe	120
PID 1548 wrote to memory of 3732	1548	chrome.exe	121
PID 1548 wrote to memory of 3732	1548	chrome.exe	121
PID 1548 wrote to memory of 1676	1548	chrome.exe	123
PID 1548 wrote to memory of 1676	1548	chrome.exe	123
PID 1548 wrote to memory of 2128	1548	chrome.exe	124
PID 1548 wrote to memory of 2128	1548	chrome.exe	124
PID 1548 wrote to memory of 3596	1548	chrome.exe	125
PID 1548 wrote to memory of 3596	1548	chrome.exe	125
PID 1548 wrote to memory of 4556	1548	chrome.exe	129
PID 1548 wrote to memory of 4556	1548	chrome.exe	129
PID 1548 wrote to memory of 4712	1548	chrome.exe	128
PID 1548 wrote to memory of 4556	1548	chrome.exe	129
PID 1548 wrote to memory of 4556	1548	chrome.exe	129
PID 1548 wrote to memory of 5408	1548	chrome.exe	132
PID 1548 wrote to memory of 5408	1548	chrome.exe	132
PID 1548 wrote to memory of 5700	1548	chrome.exe	133
PID 1548 wrote to memory of 5700	1548	chrome.exe	133
PID 1548 wrote to memory of 6132	1548	chrome.exe	134
PID 1548 wrote to memory of 208	1548	chrome.exe	135
PID 1548 wrote to memory of 6132	1548	chrome.exe	134
PID 1548 wrote to memory of 208	1548	chrome.exe	135
PID 2704 wrote to memory of 1548	2704	BManager64.exe	115
PID 2704 wrote to memory of 1548	2704	BManager64.exe	115
PID 2704 wrote to memory of 1548	2704	BManager64.exe	115
PID 2704 wrote to memory of 1548	2704	BManager64.exe	115
PID 2704 wrote to memory of 1548	2704	BManager64.exe	115
PID 2704 wrote to memory of 5768	2704	BManager64.exe	137
PID 2704 wrote to memory of 5768	2704	BManager64.exe	137
PID 2704 wrote to memory of 5768	2704	BManager64.exe	137
PID 2704 wrote to memory of 5768	2704	BManager64.exe	137
PID 2704 wrote to memory of 5768	2704	BManager64.exe	137
PID 2704 wrote to memory of 5768	2704	BManager64.exe	137
PID 1548 wrote to memory of 5904	1548	chrome.exe	139
PID 1548 wrote to memory of 5912	1548	chrome.exe	140
PID 1548 wrote to memory of 5920	1548	chrome.exe	141
PID 2704 wrote to memory of 1548	2704	BManager64.exe	115
PID 2704 wrote to memory of 1548	2704	BManager64.exe	115
PID 2704 wrote to memory of 1548	2704	BManager64.exe	115
PID 2704 wrote to memory of 1548	2704	BManager64.exe	115
PID 2704 wrote to memory of 1548	2704	BManager64.exe	115
PID 2704 wrote to memory of 1600	2704	BManager64.exe	144
PID 2704 wrote to memory of 1600	2704	BManager64.exe	144
PID 2704 wrote to memory of 1600	2704	BManager64.exe	144
PID 2704 wrote to memory of 1600	2704	BManager64.exe	144
PID 2704 wrote to memory of 1600	2704	BManager64.exe	144
PID 2704 wrote to memory of 1600	2704	BManager64.exe	144

C:\Users\Admin\AppData\Local\Temp\2026-09-01_2e77891af9e7a72fb59ca4e74a00b670_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_2e77891af9e7a72fb59ca4e74a00b670_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Users\Admin\AppData\Local\Temp\ITransponder.exe
  "C:\Users\Admin\AppData\Local\Temp\ITransponder.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\ProgramData\ms_ctrl_v1_0\ITransponder.exe
    C:\ProgramData\ms_ctrl_v1_0\ITransponder.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\OQVHGSPJRSV\SonicReflector.exe
      C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\OQVHGSPJRSV\SonicReflector.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\BManager64.exe
        
        C:\Users\Admin\AppData\Local\Temp\BManager64.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2704
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:5768
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Roaming\ctrlinterface_v2_i686\memu.exe
        
        C:\Users\Admin\AppData\Roaming\ctrlinterface_v2_i686\memu.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3740
  - - C:\Users\Admin\AppData\Local\ThreEngine32.exe
      C:\Users\Admin\AppData\Local\ThreEngine32.exe
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:468
  - - C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\memu.exe
      C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\memu.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:5080

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb5248c728,0x7ffb5248c734,0x7ffb5248c740
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,14934409794492434582,3653471951918961241,262144 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1592,i,17041180834983208908,17587375596981098010,524288 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,8569028886719169655,5360983381132081507,524288 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,18215554380695982277,1527714178992600566,2097152 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,13483108132860443907,2481585813684335178,2097152 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,1239504761838609249,5623181537491775529,2097152 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,10233723281073017529,7879540110631432107,524288 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,481804863682512914,12421320014372169227,524288 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5244,i,8195913298432364737,1646588480123316802,524288 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,2835008716700670158,17555768162853898102,524288 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,2665154957672165249,6182520571556570260,524288 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5764,i,16246649397990327358,5632911408146855464,2097152 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:2
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5876,i,2459341252398612778,10063152054798776119,2097152 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,2482820305628363289,12142281721528173469,524288 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,2440532440352741954,3248875155748176362,524288 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,15858827504854692691,3117998905897388646,524288 --field-trial-handle=2032,i,15897647752038098870,9685514802285154515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:5920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 180b178e79d63d7b21f41cd40473a470477e2bfb47f68901cd23793ad8df169b
MD5 002c2c4e9e5414369c2b71f6448e78aa
SHA1 33bcf93719685bea81ff7d1b2009f11e545268be
SHA512 58cf60ca4c2d48ad8dcf2904c20826af6dd34e29bedbee6da72821ceb987ddb2de5b012631054e7183894c1fe7286fe0c35f15c3c39429f15f2523aa4315ce7c
TLSH
T1EBE02BB9CD65EC2B29FE0728A051874AE650539B2A80494F763E850C8FF1A3B5655C5C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ed567c4125747d9103e0bc610e49c518a5aaba5c2f12a8a7891806f2a1aaba55
MD5 42c441f6d512f23e3da765dd647116eb
SHA1 fa2f6a8dd984220ce99cd5dffd2b506b1e9e5291
SHA512 77f30b6240b137387f10820b67d7e3c037ed29053ed57d1d60cad3c1e01adf16005101696231cfb609fd6ffd92cea84e0907f151275d18ee6234e1ba8c35ac98
SSDEEP 192:uRAiH8Fv72vAPRp299THsb+WNnV60/fxBkwEQaB4dVyIsnAUge:uRAic1C6XuFws0XBage
TLSH
T13A32B52EA914353BACDBD22AFA617757D7F6103135D42E84EAFC862C14E75CC222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 a4cfe9de2915a8ecb9f849ff429c3fd1e62cd81cb8eab1be87931e6ea40bcd3d
MD5 52dcba49cd7fe4f6d3421266e8579be2
SHA1 5bdf38ac18576f21f869187312b89358b0a4b506
SHA512 32fae3ae21c3931be75d646a54272211c50b1e85c1044af919736b9dffcd84143d6bbf04909a2e96a7d46aa65c4411aab30b96713774048bc58c12ddb76b8e39
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3gAHGwIB3WhmqKoUu:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOHr
TLSH
T1BF52F867688D963F4FD8C68CDC167F4FADB101566674082893FB5C08039A7CB115A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 13803edfd17b3a145dcdb35952b58cbe28c0dbf00364fcb897a59eb74d4b2853
MD5 089fb9aff7fadd075fd85f5ab5019386
SHA1 f87465e231d4fd0eea71cab43ec992e2f283b0c3
SHA512 92567da046ef668fb848512644e232c9f3c30c95b5b38b89d8dec39b5d6a7411d2616c51f5750baf4132b1a5050451fb151943f3c2c13ee6428eadeadc03cf90
TLSH
T159A0026541E05431ED4587B069B615C57292781415B1574754E18D85CD5B3D04211250
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d59a4d3acecc2aec849cbe7259ddb61c79e4e6c16f2c7417bf86ed63c749ffcc
MD5 691c36694081c8e832e223d0cc538a31
SHA1 a02448d48d5b2204e5a4dc757240ed77f3668b23
SHA512 9b1fc7a150fecb90c3bfe931cc904eec90cd4bddfcf278f49f9472953031f5499d22e2fa1276a542aff45868fd0817553e484a35f68936c00f1fc65185e19343
SSDEEP 3072:5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:4m7Rkm1tYpBeh2BAom
TLSH
T16AC3123B5E70A9775979AB4EB08E0B1F1EF14AA2D930DA82C8D85A0437F97CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 159190d95a428156692eb0e6c80baeb6e93bcf72556460aa9de6678e8dc90363
MD5 2de2253653904b539291fb08b29b5da9
SHA1 c6ff1e03a7911c1086f28121a90219ac830deae9
SHA512 1ed4d32de5a9d6fa45265fa9058f82df955a53c9e32485296e63f76f6d88ceb83570ed9211b641c7c96f513a076d1c9913f8fb2c8804b922329728b3260e3575
SSDEEP 6144:18vSoFSdIxUBB/UJCbbYZZUxim7Rkm1tYpBeh2BAoA:eaQSexUBB/tlr9oBGcAoA
TLSH
T1A53412369C35AC3749ADBA1E208F0D1F0EF18EA2EC15D674C8D02B4436FA68D5789D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 7af041561f5d68d9dba128bca5e7d186fe52773c6195e1d43f173b9c003993ea
MD5 0aa8b3fa079479c4794d052ea4ac916b
SHA1 b1dc8a917788421ecc09f488f483a1ba3d545dd8
SHA512 89340c028a1b9251327a6e6c598ff8775a0b8c62b2590eec63b658ffec9029940d0eb6cdee1435293455ff72ba145bdf145adea01857ae1b0cfcec42e6a6db59
SSDEEP 6144:q8vSoFSdIxUBB/UJCbbYZZUxim7Rkm1tYpBeh2BAoA:haQSexUBB/tlr9oBGcAoA
TLSH
T17A3412369C35AC3749ADBA1E208F091F0EF18EA2EC15D674C8D02B4436FA78D5789D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2E99E0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\2E99E0B.tmp
Size 13.7MB
SHA256 aa15fc31d25685ced9f6dc123391844476fe019a21361427aa6b8d7bb6da1b9a
MD5 e3a5a6ca954f84a665b87e2bac110d37
SHA1 07e4e20516419a939cdb53f8f1d333f4682fc215
SHA512 8616e5fcb4c83f3bdd9970e13152953db28aa605188552f98314512ec071b5376c25374505e7518a7c6f93ce3b51f2a89c2c7f223926b6171158cd91916cc940
SSDEEP 196608:64FhC+2izqcjKiWeMzqFbWOJSd1W69X2mASPx3xw7lLgtUTxrAn2jaXO/DI+4op:vFh/2iqcfiOJKDTTPxBw5YUTVfA80Dop
TLSH
T1CBE6334B876BF40B3E9B588F328C25694D485F3396C5831A89C4B1582B7EF4B7458FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2E99E0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\2E99E0B.tmp
Size 13.7MB
SHA256 a6b8c3c84bb44448dda44ffb31f61c4e5a30978565d4a40aa168f2b2e7a14c2e
MD5 ee5f2c5b2f60dcad4e6202405325a04f
SHA1 63a6368d81110696b6ef5db4a13a8a8dd6ffd50c
SHA512 3fecc74e9269aa9bc7b15a78fcbb77788d774e1e663511591813b7274bb7579d74f7d84d4fb574986acf77c56e463034d87ca492c447b97ecd6d7f2c2bcae849
SSDEEP 196608:A46hC+2izqcjKiWeMzqFbWOJSd1W69X2mASPx3xw7lLgtUTxrAn2jaXO/DI+4op:16h/2iqcfiOJKDTTPxBw5YUTVfA80Dop
TLSH
T19BE6334B876BF40B3E9B588F324C25694D485F3396C5831A89C4B1582B7EF4B7458FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51FB53D.tmp

Path C:\Users\Admin\AppData\Local\Temp\51FB53D.tmp
Size 5.1MB
SHA256 813bddfe8a9cdd904cbf30920c4a47a6916986009a2ec5e9af88076149a37da9
MD5 71c392f6b8dbb734ddf39d5e61351f92
SHA1 d462739f2afda0e32859ba32229692261827abfd
SHA512 7e479e0a19da3b5d4107ef6812d30f65e4a268bc4bb7b8213217bb2a3761f6d0fd1f8a92ad60c260749f29302f78dcb8fe5da5a641f24d78f2f86e0697cf991f
SSDEEP 98304:F4RUivgiAahKpt8rPGsQyuxx+djdSXYJL08Wp9mdsEGFTFQP2MAvrehDm/5b:F4IZ+rUys+6XML0b+RGfQP2MEB/5b
TLSH
T169363380C575EC1EBC1D332F11BD772E4791F8E225A0972DD3A2F64867908636BB8678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51FB53D.tmp

Path C:\Users\Admin\AppData\Local\Temp\51FB53D.tmp
Size 5.1MB
SHA256 e8fba6777c9253e1c724e0f5fc4916c201d3d1e9ae6830c905b2ce592d621d63
MD5 70e68366d0c8152b6467912f59fdc5ce
SHA1 ca3f07687648b4229761a3b4591d87a1aa4d6f91
SHA512 a726c52f631c9f6a191bd949608485882c52c0f3b0bffb15c18d700239078a844faf67e9910630ee1b7d7d4e23290e3b673152191ce7982c8414c155e680c45a
SSDEEP 98304:w4RUivgiNahKpt8rPGsQyuxx+djdSXYJL08Wp9mdsEGFTFQP2MAvrehDm/5b:w4FZ+rUys+6XML0b+RGfQP2MEB/5b
TLSH
T187363380C575EC1EBC1D332F11BD772E4791F8E225A0972DD3A2F64867908636BB8678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60f8-9710-95ad-b1c2.tmp

Path C:\Users\Admin\AppData\Local\Temp\60f8-9710-95ad-b1c2.tmp
Size 18KB
SHA256 4e0dfb1bca4441a67b0b0d288651e5d6eb73354e58d9d2c3d5e65bc3c4a02c49
MD5 cabd077da203c01a7f7d7d71c1848a45
SHA1 caf5d155cf5a9e265b0a0cc892d65fd1d1c97ea2
SHA512 e0c7e41f7c77ae7df15d08ba3adc4659c9ed3bef17e90177ddc10c401842549e003db927411acecea1ca5e0eecfadbf39bd22d6fcd81076ae6e112f8a1814762
SSDEEP 384:Lx9FmKSE5Bf9I9BPmb5WstbMiADt1ymhchOT:Lx9j5aPmRcDt1ym6gT
TLSH
T14A82D16473AC546BD4FF46E009E1D014B0787F26ED8A3CDF50B9C84B045CA9E3495DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7D5D1B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\7D5D1B0.tmp
Size 40B
SHA256 9acd9a8f9ebb00e1d02dba1e00a5bc8930c573ca206b69e36d5039bb9ef46193
MD5 f69f5cd1cce5897dc1b13643eeeabd7d
SHA1 81af40e54f00bd894bc0ccc3779b60a4d06c78fb
SHA512 75645dd367c759defab2eb60be067f81df8a50a00f64c19a414d8f494826d5457868911af8db4047956b507e4107c141912f16d980cec335e1b12cfed795f5ee
MD5 SHA1 SHA512

Submit Download

978E2D6.tmp

Path C:\Users\Admin\AppData\Local\Temp\978E2D6.tmp
Size 40B
SHA256 7ae44c9e8c60c5687858bbcbc79528da22f08471f9f4777ee82bbcb20f3186b4
MD5 c440b942066bbb53a978e72b899a592b
SHA1 60e7dbda21f877b3fe95b3afaa84fea3b6178da9
SHA512 f63c33a1aa5062f0cdf9721a6c58576652a184efad469b02b39682e16dcbe9b66ebfd1c183a2a46e975c5d644e802c71ea5c88864587161622672799fdf034b4
MD5 SHA1 SHA512

Submit Download

BManager64.exe

Path C:\Users\Admin\AppData\Local\Temp\BManager64.exe
Size 546KB
SHA256 1d1d2245651632f1fce464eda9d5c5ea6ca43b4a04424601ce8c890951111028
MD5 c39a4cca58bedd9b3ceda4d0d3e1e94a
SHA1 0ea31e219e83aa4ba169ef2a132af8fb52f54bf4
SHA512 673794aee7f54a6a1191069a1647ff085c8da6c9bdcb8e358e9969c51c9782993c5e73b938bb4388af012a6cb279e1faf324af55c49748a85b8159c170f4252f
SSDEEP 3072:BBPlwpY3YKF0MrrJq+DNBg0DJtOJs9cAg0Fub+A5aiMqKIDqLqprqpB:rc2XFRJ3DNuzAOS9F4DqLqprqpB
TLSH
T199C43821B4C1E47AC862073008E9E6B57579FC215E72863F33F47F2F3B762816565AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ITransponder.exe

Path C:\Users\Admin\AppData\Local\Temp\ITransponder.exe
Size 1.6MB
SHA256 2570d1530ab4fd7b75d6ab905b5621ce5ed2ec0c5128295837b994c758d0ae25
MD5 7ce48dcb0a9fd2b98cefdcd11683ea03
SHA1 6b1eaa26d2596c9c5e99f9a0d2ea8e0295611b33
SHA512 159d9a7b1389272f42d53c1a064ff521d45430ba38231411aafc563c1d1dd9fb12a360a5630375ef1685045e193d1c0a524d4c810b88a69d9b9bd88d52fe6f18
SSDEEP 12288:Fkz7KHRu+LuwOnN0tRHFzHMoKdD/mn7Mg3qI70cr+h5A3L0Nsyk2:Fkz7Kxu+LuJuoLO7MO0cr+h5QoNsz
TLSH
T1CE753B203A29DA37E656A1F0497B5E1E0CADDD55077900D7D3F80E7D2DB0AF22B3264A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCR100.dll
Size 756KB
SHA256 25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8
MD5 ef3e115c225588a680acf365158b2f4a
SHA1 ecda6d3b4642d2451817833b39248778e9c2cbb0
SHA512 d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a
SSDEEP 12288:amCy3y9cSWI5vMBEWL3XU8+n6ODOlMFgvXmteA5RLTDz7sHA9p++/pj:amCy3acqvM6WL3XU8+n6ODxgf4eUH7Tt
TLSH
T1D8F49E11B692C073C17221300629D7B25D7BB9711034A46BBBD99F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IntelliTrace.Profiler.dll

Path C:\Users\Admin\AppData\Local\Temp\Microsoft.IntelliTrace.Profiler.dll
Size 1.0MB
SHA256 811d7180d635a75d95a4e10eba6047c5f58532ecf48f3135f75fb4febf47a3eb
MD5 4bea6504751d2f357c0116425a24fb96
SHA1 f4734421095b85f09da8d9e85c29ee598c8b49ad
SHA512 c48022875405c656d8a4b02fb61c13d260bb1c2c33e41b3a295e271dccb4b38938a39790eee859de419dfed2498ed8abd5e224aedcfe6e1828ccdc8f76151051
SSDEEP 24576:PJpmbCdJLuP/8srf1SW9AuUjnbPoNkj+JYTfnrV7mS9V:PzSCG38Efn9AuwnbPoNkj+J6frV7mSz
TLSH
T127357B213641C43AE9AE02B02D7DF37E267DBEA92C70821777D8FA5D59B0411EB07A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc120.dll

Path C:\Users\Admin\AppData\Local\Temp\mfc120.dll
Size 4.2MB
SHA256 e7647532a382d3aa6a07fd45844d90fa29cd1d3905fdc893e7ac5d0063d09276
MD5 9015b3631e2054c1b29500375e92b0dd
SHA1 c0adf911530ced20d78216eec99e87466c36d24f
SHA512 3688f5f54d087b38f6346f972df89c80eb798a5bb25f1c5d17c134a81e5ddfacd2d1d4ffa8df3602fc5e23b7b8f34e799b693b6591efedb0d5044f2ff06fcc52
SSDEEP 98304:oehHn9mBz4+RlWsoa7/qdS0+xs82dGnbBuFLOAkGkzdnEVomFHKnP/08U:Cn6+xs82dGnduFLOyomFHKnP88U
TLSH
T1BC26BF02BFED80FAD66F13315E59773CA6EEAE94E830435722543F2EF9712026929117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp120.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp120.dll
Size 444KB
SHA256 0e535e147d253fc645ccb9406c888aee374ab1f3f9d99dc057a2b19cf401458b
MD5 854fb5751985d6d40fa12bc9c3e82be5
SHA1 e57cc61a59e88d2b6a373abca622af259c58be4e
SHA512 03c9e9886f20249547193351750fc5bd8b5f32e354162ca9be04d8a65a701d73d2ad86ede9606a38ba6e030f2a9c02efc60d409411991bbb636340f1c258c32a
SSDEEP 12288:UQHbDqy90l5yQBggQerjhUgiW6QR7t5ss3Ooc8DHkC2ehaxPe5:JbOqQbnrws3Ooc8DHkC2ehaxK
TLSH
T152A44B237B864CF1D19E53B231C9531257FAFC6541A1F303ABEEE1593FA6286E223611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 485KB
SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
TLSH
T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr120.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcr120.dll
Size 948KB
SHA256 82225ec7e2da43a7a72a3d523698747512523afa488767ca6839c63a7a5706fa
MD5 7dabb11da67d32c5dc917839fcbeb16d
SHA1 198923794549bc37e8b05a326a403eedadba7b55
SHA512 5e65b49ace7bffddeea1ad3c3aa777d6e23024b91b8bff3db1d1f4955d718d277e88428d671ce232807fc166818b891e8b0535b6aa4c21032dbc99840321fdd6
SSDEEP 24576:UmFyjHVMxBuwQLYucGp4iiqgNb3HopbiKJ:iMy2yRgFopbh
TLSH
T19D25AE12B982C0B2C57602B1152DE77219BFB971443684B7ABD98F0E1DB46C0FB67B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51310798-d405-4497-ac1e-f77995be3162.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1548_580286339\51310798-d405-4497-ac1e-f77995be3162.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1548_580286339\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

socket64.sys

Path C:\Users\Admin\AppData\Local\Temp\socket64.sys
Size 7KB
SHA256 ef974bccc9078b809c87fcd0445f63f213c4ebaa33d7d3997b58d9be1b15e930
MD5 ca5e334a083e4546f957eb52cac0a1dc
SHA1 955f913b0be3ebc38edcc286edaa213728634558
SHA512 8907f5e533e41e4f5083fa804d11632968142b38cefdc95c648054ee3bcf3a475888174a2f8b6b976450cbf4235d282cc10c1ec3b1791669b96655f5a9662012
SSDEEP 192:Q6TTI4JMnI0hew1lAF+v2sZ6TdUzhDnJrJx2rmzqcE:RTTIqSkFqvZM6zbX22E
TLSH
T1D1F108CB1EB37D16C89DF9029A9F17804B847DCEAB557260389A982E7059B650404BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stencilclient.dat

Path C:\Users\Admin\AppData\Local\Temp\stencilclient.dat
Size 10.6MB
SHA256 44de4fdb12c056856930fbb69fdb9c10ed1a4c120dc0687e610f24d05bc92075
MD5 08f06544897daf51ef2f41b794d370b0
SHA1 1df7388d63d85d9cbbd54ccd1b6a3258474df3d9
SHA512 8f2aa14181d8448dd33799fb32c546006b51e7269cc4b7c289d53723fdb7e86cac6984d50f7db166407befff87f34c6f8ec9f4859d253a17a3940e9228f26180
SSDEEP 196608:p+TQ9cBEcbs/aoaYOSG4rWms6cpLABwDSVQ1aVKyAxue6+XciQE3mwa+Hvu78tH:KqibpUh6pFSVQ1aEQ2/T7PPF
TLSH
T10EB633DAC69C0700EA9BE7F6DB0D5DB27C926A1B08273706972045AB1CCB0ED555BF83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xerces-c_3_1.dll

Path C:\Users\Admin\AppData\Local\Temp\xerces-c_3_1.dll
Size 1.8MB
SHA256 3504d24b674f59508427a5aa2bcde8066993f9a183557e18053032e12902451c
MD5 ae3d0e5134f58cefa17b3108cc028ba4
SHA1 be653b8dd71c9c7ff08065e1d1cbf67a04033f72
SHA512 d27104aeecf06e7cfa3971cfb73cdc9c76a8757d2451b95ef163d93f4bc395865e1360e77c06d332fc07674cda4324faf85b944fac5af0bc8d43f8e263670ed4
SSDEEP 24576:V/vHDdxWEuv3uhYEI8Vibo1LYhbMSlkkNoZf:BP0u+EI8kUhYjHod
TLSH
T15E95F663BB96E066D292A2740CE6AF5450BDFF868470B306DECA033D84717B8155BB1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThreEngine32.exe

Path C:\Users\Admin\AppData\Local\ThreEngine32.exe
Size 492KB
SHA256 76c078bebcb9d93712063be28f7ba16615020f4f8ede8f70fed55985fcd270e1
MD5 a49e72b2505dc8dee942b0a39583675c
SHA1 1f21f1416f6fa8e0a0d5b2e7b1ac9df22d52c248
SHA512 12670de58c38168cf033cbf0822863a17076bb0670779b54ff29079a54a7ec1db9de188d4f9183bc7b6b46a4d9d003f6f6daacdd8064ef89091a31a0f454b86d
SSDEEP 12288:VpJVuIPG6LiEknQuqqQMhPMQawlzKoFqX/pkUewgyux:3PO+oneMhPMQawlzKoFA/pzzux
TLSH
T11BB4CFE1D389FCF5E05B01BA8C31D912255BF62D89B8096A242E71256A7378734FBD0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\ctrlinterface_v2_i686\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRClient.dll

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\OQVHGSPJRSV\CRClient.dll
Size 1.9MB
SHA256 e57152a250ed27ee106c415600f91731ce1c396212025dbab7387953241cc18b
MD5 0197fc30b7b88d1b3cea487e641b23db
SHA1 3401ac2ba5e05bfe192086e7c8d2512f48591f0a
SHA512 22fe7a9af66198b48edff7571c6f000ab0f42e2a3b0a30e578c2fb8f5d2349461c8b3b7918919d2b80632a64f51726330c9d45bc0d05b189b0e51e566e296ee6
SSDEEP 49152:oUJ9oFQdzj7Ybm858J4d1ayhwFnU1G0nEre4fZhVjbAP:o5bZ8J4d1DhwpUI0EreJP
TLSH
T1D7956C0763A901ACD5ABD3788A1B5A07E376780513759ECF039086A92F77BE15F3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SonicReflector.exe

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\OQVHGSPJRSV\SonicReflector.exe
Size 2.4MB
SHA256 6c4b6b6826186586b785409b1f163b1bcec59ca7540e3713aa58c3023aff0280
MD5 a9d73167ef04c480dfa730dfdade36ee
SHA1 afdd8f999d57ee7dd74796f0f688e53433cc000d
SHA512 2ecd3ff537837b70390ec78e8c911bce58749193a52fc137a69d243e306d962eee62e7c73bff375ec757822d5a06e4c499dc75690cef8ee7381ead06d49346e9
SSDEEP 49152:vFy3cSdUDKcL8h8ZI9dxquPYjOfNv2TWcWhynVxaD5D3TbCatr4VdKYU:vFhpbMN3yVxUwar4VdKl
TLSH
T11FC57C5762A801D5E1F6D13C8A67841BE6723C160731A6EF12B06A5E6F37BF04EBE710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\OQVHGSPJRSV\VCRUNTIME140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\OQVHGSPJRSV\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocol_dump.json

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\OQVHGSPJRSV\protocol_dump.json
Size 4.4MB
SHA256 7f402d4bff429725c6791b0390b8263b23dc61d2321313b0ee65edaace4610fb
MD5 dd32f5a87904c20257fac8e23f16ec33
SHA1 fc6556a388f41d5350ded7663b7de56680867925
SHA512 fc76ffc02146a0235801e1005b0a62d65f44b860cec03b05d916592d3b5a21a3e49a70f8f22b6e0187e86f46310319b0638c62e12126ff2123eeeb2400711232
SSDEEP 98304:IZSP7L0Xl/rayLn8T/PFAJWZJsTEBh37Y9dMhDC6GrzKVOxRt:I2s1uyLrJ2Z3EyDYzKVOxT
TLSH
T1B626232AD6976073F58AC4F758EE634E8D9A31901355E13A413A87DD81CBB43CA263CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandbox-impl.conf

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\OQVHGSPJRSV\sandbox-impl.conf
Size 35KB
SHA256 a8efe1b488cb9204e1d5803909b51f64ff752cdf90a419319095676cc100825f
MD5 fb973784fe0b283a0c68365f2b398471
SHA1 fc5f01d24de0393b2a0a8c9b594b8e4ecb0d1ba6
SHA512 2d461e5cd830dc45051c58f4f50598e07c99ab80eea2623821b870e6315e6d3d7c3b632f7dfb2bc34f37b99d5645c31bcbe33567073381459f53b6583c977084
SSDEEP 768:KaLS1GUeGs9bLN1VYV09ZC2ybYe66sCikwUoJRDJaotoXR2:/LS1gXJbVH9ZE8e8BUcDsotoB2
TLSH
T19AF26CE34F6B7B35784DB47AA039A4A3C264FDB1BE0D0071FC865507A4275D9A322DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\OQVHGSPJRSV\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-206-0x00007FF6B92F0000-0x00007FF6B9580000-memory.dmp

Download

memory/468-466-0x00007FF6B92F0000-0x00007FF6B9580000-memory.dmp

Download

memory/468-484-0x00007FF6B92F0000-0x00007FF6B9580000-memory.dmp

Download

memory/468-156-0x00007FF6B92F0000-0x00007FF6B9580000-memory.dmp

Download

memory/468-515-0x00007FF6B92F0000-0x00007FF6B9580000-memory.dmp

Download

memory/468-523-0x00007FF6B92F0000-0x00007FF6B9580000-memory.dmp

Download

memory/2364-132-0x00007FFB544F0000-0x00007FFB54550000-memory.dmp

Download

memory/2364-145-0x00007FF7E5550000-0x00007FF7E57BF000-memory.dmp

Download

memory/2364-125-0x00007FFB544F0000-0x00007FFB54550000-memory.dmp

Download

memory/2364-128-0x00007FFB544F0000-0x00007FFB54550000-memory.dmp

Download

memory/2704-134-0x0000000000700000-0x0000000000ABD000-memory.dmp

Download

memory/2704-170-0x0000000000700000-0x0000000000ABD000-memory.dmp

Download

memory/2704-155-0x0000000000700000-0x0000000000ABD000-memory.dmp

Download

memory/2704-154-0x0000000000700000-0x0000000000ABD000-memory.dmp

Download

memory/2704-149-0x0000000000700000-0x0000000000ABD000-memory.dmp

Download

memory/2704-144-0x00007FFB6FF30000-0x00007FFB70125000-memory.dmp

Download

memory/2704-139-0x0000000000700000-0x0000000000ABD000-memory.dmp

Download

memory/3740-163-0x00007FFB6FF30000-0x00007FFB70125000-memory.dmp

Download

memory/3740-442-0x0000000075210000-0x000000007525F000-memory.dmp

Download

memory/3984-174-0x00007FFB6FF30000-0x00007FFB70125000-memory.dmp

Download

memory/4820-102-0x0000000075210000-0x000000007525F000-memory.dmp

Download

memory/4820-93-0x0000000075210000-0x000000007525F000-memory.dmp

Download

memory/4820-104-0x0000000075210000-0x000000007525F000-memory.dmp

Download

memory/4820-121-0x0000000075230000-0x0000000075231000-memory.dmp

Download

memory/4820-124-0x0000000075210000-0x000000007525F000-memory.dmp

Download

memory/4820-99-0x0000000075210000-0x000000007525F000-memory.dmp

Download

memory/4820-83-0x0000000075210000-0x000000007525F000-memory.dmp

Download

memory/4820-108-0x0000000075210000-0x000000007525F000-memory.dmp

Download

memory/4820-96-0x0000000075210000-0x000000007525F000-memory.dmp

Download

memory/4820-90-0x0000000075210000-0x000000007525F000-memory.dmp

Download

memory/4820-80-0x0000000075230000-0x0000000075231000-memory.dmp

Download

memory/4820-81-0x0000000075210000-0x000000007525F000-memory.dmp

Download

memory/4820-79-0x00007FFB6FF30000-0x00007FFB70125000-memory.dmp

Download

memory/4820-78-0x0000000075210000-0x000000007525F000-memory.dmp

Download

memory/4828-47-0x00007FFB6FF30000-0x00007FFB70125000-memory.dmp

Download

memory/4828-46-0x0000000073950000-0x000000007399F000-memory.dmp

Download