hijackloader | eb24fcf88b060573af06bcc5facd2d08894966b625cf42e0fa15da22a5acdaa2

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_2e77891af9e7a72fb59ca4e74a00b670_elex_wannacry.exe
Size 12.7MB
Sample260903-rmgcssak5x
SHA256 eb24fcf88b060573af06bcc5facd2d08894966b625cf42e0fa15da22a5acdaa2
MD5 2e77891af9e7a72fb59ca4e74a00b670
SHA1 9bec74e34ca092c16b9c4c2b4c5ab754a85c05dd
SHA512 433de304d8a3842abe335ea88e6d38f4c52a719ec9015abbe9b127b276812bbe64886ce2aa30017c6266c947d32e4f1a5867c688b93c9e712ef62e0f405e1e88
SSDEEP 196608:+ps3WdBhkJqoYux2yjaMd9UvDAoMK6ZG+rUZcQj4rOd5OFYKg5RipuDjcY/JNaZI:+ps3wPkfgwd9UvAP4fj4yYF4TaZW/rP
TLSH
T14DD63340B789BAF5D02A5B728B12CF653533FF97AD110F97458B1C489F933A1AA0B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

5b0b21ab0f10edc736d445bb9ea3a4df credential_access discovery hijackloader vidar loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\ms_ctrl_v1_0
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

vidar

Version

Botnet

5b0b21ab0f10edc736d445bb9ea3a4df

https://62.238.125.238
https://t.me/nag0a
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=EMqJL

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:34.0) Gecko/20100101 Firefox/34.0

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c599-45.dat	family_hijackloader
behavioral2/files/0x000c00000001c5ba-102.dat	family_hijackloader

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/memory/5832-153-0x00007FF7F9B00000-0x00007FF7F9D90000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/5832-157-0x00007FF7F9B00000-0x00007FF7F9D90000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 3 IoCs

pid	Process
4532	ITransponder.exe
2704	ITransponder.exe
4188	SonicReflector.exe

Loads dropped DLL 24 IoCs

pid	Process
4532	ITransponder.exe
4532	ITransponder.exe
4532	ITransponder.exe
4532	ITransponder.exe
4532	ITransponder.exe
4532	ITransponder.exe
4532	ITransponder.exe
4532	ITransponder.exe
2704	ITransponder.exe
2704	ITransponder.exe
2704	ITransponder.exe
2704	ITransponder.exe
2704	ITransponder.exe
2704	ITransponder.exe
4188	SonicReflector.exe
4188	SonicReflector.exe
4188	SonicReflector.exe
4188	SonicReflector.exe
4188	SonicReflector.exe
4188	SonicReflector.exe
3888	BManager64.exe
5832	ThreEngine32.exe
5556	memu.exe
1236	memu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 5832	2704	ITransponder.exe	91
PID 4188 set thread context of 3888	4188	SonicReflector.exe	92
PID 2704 set thread context of 5556	2704	ITransponder.exe	95
PID 4188 set thread context of 1236	4188	SonicReflector.exe	94
PID 3888 set thread context of 5360	3888	BManager64.exe	99
PID 3888 set thread context of 4440	3888	BManager64.exe	123
PID 3888 set thread context of 5360	3888	BManager64.exe	99
PID 3888 set thread context of 2244	3888	BManager64.exe	136

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	BManager64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	BManager64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	BManager64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	BManager64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt	BManager64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	BManager64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	BManager64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	BManager64.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	BManager64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	BManager64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	BManager64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	BManager64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	BManager64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	BManager64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	BManager64.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\dbghost_arm64.job	memu.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITransponder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BManager64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_2e77891af9e7a72fb59ca4e74a00b670_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITransponder.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329188164354741"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3888	BManager64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4532	ITransponder.exe
2704	ITransponder.exe
2704	ITransponder.exe
2704	ITransponder.exe
2704	ITransponder.exe
4188	SonicReflector.exe
4188	SonicReflector.exe
4188	SonicReflector.exe
4188	SonicReflector.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
5832	ThreEngine32.exe
5832	ThreEngine32.exe
5832	ThreEngine32.exe
5832	ThreEngine32.exe
5832	ThreEngine32.exe
5832	ThreEngine32.exe
3888	BManager64.exe
3888	BManager64.exe
1236	memu.exe
1236	memu.exe
5556	memu.exe
1236	memu.exe
1236	memu.exe
1236	memu.exe
5556	memu.exe
1236	memu.exe
1236	memu.exe
5556	memu.exe
5556	memu.exe
1236	memu.exe
5556	memu.exe
5556	memu.exe
5556	memu.exe
5556	memu.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
5360	chrome.exe
5360	chrome.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe
3888	BManager64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3888	BManager64.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2704	ITransponder.exe
4188	SonicReflector.exe
2704	ITransponder.exe
4188	SonicReflector.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeDebugPrivilege	3888	BManager64.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4532	4788	2026-09-01_2e77891af9e7a72fb59ca4e74a00b670_elex_wannacry.exe	88
PID 4532 wrote to memory of 2704	4532	ITransponder.exe	89
PID 2704 wrote to memory of 4188	2704	ITransponder.exe	90
PID 2704 wrote to memory of 5832	2704	ITransponder.exe	91
PID 4188 wrote to memory of 3888	4188	SonicReflector.exe	92
PID 2704 wrote to memory of 5832	2704	ITransponder.exe	91
PID 4188 wrote to memory of 3888	4188	SonicReflector.exe	92
PID 4188 wrote to memory of 1236	4188	SonicReflector.exe	94
PID 2704 wrote to memory of 5556	2704	ITransponder.exe	95
PID 2704 wrote to memory of 5556	2704	ITransponder.exe	95
PID 4188 wrote to memory of 1236	4188	SonicReflector.exe	94
PID 5360 wrote to memory of 2760	5360	chrome.exe	100
PID 5360 wrote to memory of 2200	5360	chrome.exe	102
PID 5360 wrote to memory of 2200	5360	chrome.exe	102
PID 5360 wrote to memory of 4284	5360	chrome.exe	104
PID 5360 wrote to memory of 5232	5360	chrome.exe	105
PID 5360 wrote to memory of 5232	5360	chrome.exe	105
PID 5360 wrote to memory of 2900	5360	chrome.exe	106
PID 5360 wrote to memory of 2900	5360	chrome.exe	106
PID 5360 wrote to memory of 3344	5360	chrome.exe	107
PID 5360 wrote to memory of 3344	5360	chrome.exe	107
PID 5360 wrote to memory of 424	5360	chrome.exe	109
PID 5360 wrote to memory of 424	5360	chrome.exe	109
PID 5360 wrote to memory of 5228	5360	chrome.exe	110
PID 5360 wrote to memory of 5228	5360	chrome.exe	110
PID 3888 wrote to memory of 5360	3888	BManager64.exe	99
PID 3888 wrote to memory of 5360	3888	BManager64.exe	99
PID 3888 wrote to memory of 5360	3888	BManager64.exe	99
PID 3888 wrote to memory of 5360	3888	BManager64.exe	99
PID 3888 wrote to memory of 5360	3888	BManager64.exe	99
PID 5360 wrote to memory of 4108	5360	chrome.exe	111
PID 5360 wrote to memory of 3676	5360	chrome.exe	113
PID 5360 wrote to memory of 3676	5360	chrome.exe	113
PID 5360 wrote to memory of 1080	5360	chrome.exe	114
PID 5360 wrote to memory of 1080	5360	chrome.exe	114
PID 5360 wrote to memory of 3180	5360	chrome.exe	118
PID 5360 wrote to memory of 3180	5360	chrome.exe	118
PID 5360 wrote to memory of 5800	5360	chrome.exe	119
PID 5360 wrote to memory of 2692	5360	chrome.exe	120
PID 5360 wrote to memory of 5800	5360	chrome.exe	119
PID 5360 wrote to memory of 2692	5360	chrome.exe	120
PID 5360 wrote to memory of 872	5360	chrome.exe	121
PID 5360 wrote to memory of 2412	5360	chrome.exe	122
PID 5360 wrote to memory of 872	5360	chrome.exe	121
PID 5360 wrote to memory of 2412	5360	chrome.exe	122
PID 3888 wrote to memory of 4440	3888	BManager64.exe	123
PID 3888 wrote to memory of 4440	3888	BManager64.exe	123
PID 3888 wrote to memory of 4440	3888	BManager64.exe	123
PID 3888 wrote to memory of 4440	3888	BManager64.exe	123
PID 3888 wrote to memory of 4440	3888	BManager64.exe	123
PID 3888 wrote to memory of 4440	3888	BManager64.exe	123
PID 5360 wrote to memory of 4112	5360	chrome.exe	125
PID 5360 wrote to memory of 4112	5360	chrome.exe	125
PID 5360 wrote to memory of 3772	5360	chrome.exe	126
PID 5360 wrote to memory of 3772	5360	chrome.exe	126
PID 5360 wrote to memory of 4060	5360	chrome.exe	127
PID 5360 wrote to memory of 4060	5360	chrome.exe	127
PID 5360 wrote to memory of 2628	5360	chrome.exe	128
PID 5360 wrote to memory of 2628	5360	chrome.exe	128
PID 5360 wrote to memory of 1072	5360	chrome.exe	129
PID 5360 wrote to memory of 1072	5360	chrome.exe	129
PID 5360 wrote to memory of 2980	5360	chrome.exe	130
PID 5360 wrote to memory of 2980	5360	chrome.exe	130
PID 3888 wrote to memory of 5360	3888	BManager64.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-01_2e77891af9e7a72fb59ca4e74a00b670_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_2e77891af9e7a72fb59ca4e74a00b670_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\ITransponder.exe
  "C:\Users\Admin\AppData\Local\Temp\ITransponder.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\ProgramData\ms_ctrl_v1_0\ITransponder.exe
    C:\ProgramData\ms_ctrl_v1_0\ITransponder.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\TFWXNARCXFJGQV\SonicReflector.exe
      C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\TFWXNARCXFJGQV\SonicReflector.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\BManager64.exe
        
        C:\Users\Admin\AppData\Local\Temp\BManager64.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3888
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4440
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:2244
    - - C:\Users\Admin\AppData\Roaming\ctrlinterface_v2_i686\memu.exe
        
        C:\Users\Admin\AppData\Roaming\ctrlinterface_v2_i686\memu.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1236
  - - C:\Users\Admin\AppData\Local\ThreEngine32.exe
      C:\Users\Admin\AppData\Local\ThreEngine32.exe
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5832
  - - C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\memu.exe
      C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\memu.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:1088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x114,0x108,0x104,0x10c,0x134,0x7ffe2d86c728,0x7ffe2d86c734,0x7ffe2d86c740
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,1500589977230046320,12655118831979019580,262144 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,17505127266793020031,14631522939863920900,524288 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,15596302261903282623,17941147869046953033,524288 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:13
  2⤵
  PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3024,i,7520190899009318171,7060800149668270789,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3028,i,16873362507114748103,14408813719960914908,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4636,i,1308273295187283140,12557270088800870404,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4788,i,4474974057224306547,7694928435053063397,524288 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,10237371654677240433,15752263409480162617,524288 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5472,i,17403568100371037024,9314352791426633660,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5516,i,14355794150345530954,2473334645665998447,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5464,i,11260341925951856919,3801167746180376940,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5500,i,8253908995927090004,9978895260501777188,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6440,i,1560879094464874292,10022443503657641581,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5512,i,8048933818037428563,16798747484522660384,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5488,i,12368417351834887310,9363286087497850052,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5736,i,1431102070795004624,1924800641982305524,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,13767985941772648582,7304276468072271467,524288 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6368,i,14601960022939454763,7996166253885852030,524288 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6404,i,636254668808866919,87149079470991588,524288 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5768,i,7978161069837160458,12813191206397053251,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6516,i,13187357828685751967,10323412782193671215,2097152 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:9
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6148,i,13664998858763135127,16856638869578463346,524288 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,8871396326273154962,15965432845736900785,524288 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,7095745009492847072,16301736112716889421,524288 --field-trial-handle=1904,i,10997584923248156446,615699488236196894,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5148

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2508

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6fc00588e0b735bcf0002499229a8d627dc30d4074915c8abfd6dacf67f75669
MD5 65ef1da75c1701342baec3abde7d76a7
SHA1 fff62dc412c7ebd7a6ba41671a326a2f83c52bb7
SHA512 ed332a40eac9849d0c9d788e86f1e85e99bc249aefc824d941533bbc6961851b3ca82475467d80ba20351bd9ac8d17c5dfa72839558e5ad79a5f75ab21646847
SSDEEP 192:dR9NAwb/2/v7cAPRp2s9EHsb+WNnED0qN5Apba+kVyIsnAUgR:dR9NjwJX7mwA0q89aVR
TLSH
T15532962EB911293B6DCBD21AFE21B793D7F5102221942E88D7F9462C25E75CD2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a31e74e35692b53f74e771d8c6a6ff97fdc02cc9dd1b36df084db90aabf4feef
MD5 b2693f5222f8f6b4c679b3a1dea311f1
SHA1 fe19699972ddbe7621bdc9748b86b8f3f35dceef
SHA512 27f5f047b2e9039e785f8da0072b341f506172b7f21c5378c6e1922088d2bbe0ee248a38c3b6ec2956a06adf7d3e55243f0ff4a217325d1437fe060f59d6381a
SSDEEP 192:e3Q4K6NE+97KxkXqK4I40pUZNCgVLHrKHfFKslEi5PRXzKD/8E+d+ErUkKN9t7vU:WQjZ07KxkXqKf/pUZNCgVLH2Hfgsljhz
TLSH
T19E32E967A48E9E3F4FDCD90DDC126F8BACB5029662780C2493FB6D0803957CA114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 879c7289826710db19e094b755b4cbbc3c4e9fa241aa3163f16e699271cd807a
MD5 7e0341b077b58c9df6ba9a6916bb2f2d
SHA1 86e50999121579974fabce2d67548ec9bbd3aca9
SHA512 cd7c061499a8ebf10df203ddceec4dd1fbe3d5bcf4b116fca62bb480403b6e66ecd5ddb6a8d7beac5a2d57ffdb3935e24a0718f329f789f87197cbffb410f144
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d305863604b065390d1e2273344bf8e320c94a96750f46d533b46f0f680ce211
MD5 8c634a0443735130206e4a5f7297778a
SHA1 7a0650cb0e46788ee44df057e233cfd042d3960b
SHA512 6aeb35fc968e2c31d54174ee76eb42621a65fd78c6ce0e9fc690b205f311fb91d70eb78bdeb96dd97221f69c116a55dfae54e755e359fbf723154145e2fac033
TLSH
T149A00261C1F43411FD8862F261B1B9C6625548151791530754AFC44CD89B9C04105502
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7c015d8b722adaef9084b4b64c3777194422b5c5dee2bebf1204a74bd81345b0
MD5 26ba9d1e9f0c3cd83c16d9a1969d76a4
SHA1 fe614c241ba0b5fe609aa14eef609a5f5f0e3440
SHA512 d2315e6f16fb43c188862a28c0b1580f60d511cde029b84b98e41d53db89e3f1316cd57fcaa7713c477c73d6ac182c5531bc3c6180c9ed15b49692388eb86926
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5xlDTB60GyvnnXwlbKmb0v4a:xC0PtbKFKu00UUSb/iDUDbNECXwlbK7
TLSH
T1DCA13C72B4698D735975D54AFC622A03CF74E12B9D229F54D9CD0F0C00F70E80342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 c1f3bf2f61efabd6a48d1f712b5773c7fea436123983e71c7d7723b2587b90cb
MD5 36eff26e534edd7b78b9fa05ff76bdea
SHA1 8bbd06ef1086808fe35316a66874b5fb319f205f
SHA512 2d8e39a0d6e529e47891657e9b91fcf3be8801d21fd8361c21f64654cf49241ec435d7943e6aa466834836d377039562ee7cb17a9e2b38318f94592b56df540a
SSDEEP 3072:xbvX72oIkSMN7o7pfLmxUVJq0AY/3EK48A0jnbh+ZZK3Nxp:VvSoFSdIxUBB/UJCbbYZZUxp
TLSH
T116D31230983A6C374AAEED2D1057081FDAE18AB7BC47E67CC5901B4724F751E938AE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 30cd8e6f6da043fa1e368d18905f32489a1074ba250c601242b1e6a3981d2dab
MD5 2f627a95ef5a22b2750f75ee3605ea38
SHA1 62bf3fdf8aa1251d9a300a80925e6b39d0f2be41
SHA512 e3f2c2723ee60ca5116c1cc63f1cee542a1e888d35ac3ec75b5c23c2bd9333db1e8c56ff7b0bad9d9262a4741219150ce77a62731ed081b5e8a19c62371eb6bc
SSDEEP 3072:LbvX72oIkSMN7o7pfLmxUVJq0AY/3EK48A0jnbh+ZZK3Nxp:vvSoFSdIxUBB/UJCbbYZZUxp
TLSH
T120D31230983A6C374AAEED2D1057081FCAE18AB7BC47E67CC5901B4724F751E938AE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16DE013.tmp

Path C:\Users\Admin\AppData\Local\Temp\16DE013.tmp
Size 40B
SHA256 e9e5788abc4923cbd49d0c9cd76b52139628337619409ab0fdb2c1e1ee6dcbeb
MD5 8cfe365bfc318514b4a482e5ccf28f2c
SHA1 a17da8be4530ee2b5534b85e6c175a888d49e923
SHA512 098dfb8c9ae8515e8bde05fce9e0121bf55693338aeea3d3336f638493b874aceac96eef23cd5aa122296aa5e7694392a96458b43b421593c7b0bbff46b4bd4f
MD5 SHA1 SHA512

Submit Download

1BFE36E.tmp

Path C:\Users\Admin\AppData\Local\Temp\1BFE36E.tmp
Size 40B
SHA256 29fb98000d5e724afabba019c1fb0cc0f1b898fc88eafddf54b5ee1d4420a2eb
MD5 6845474153dc815449f5ac00d10abc23
SHA1 b8cd345d5e361953cccdf04d59ba78553e6b28a8
SHA512 4a9db130a0f92ae776b0bd2b0bb02b679359f22a1fd32a1516eed3e6b800cb4e6ce39895eef3e36c70146c55306e81c1e6bd9874eba75bc5e84d2b32c6fb5939
MD5 SHA1 SHA512

Submit Download

1PWxj.7z

Path C:\Users\Admin\AppData\Local\Temp\1PWxj.7z
Size 18KB
SHA256 aeab43f7474c3faa3227f5f055811a95b4a05bea127fdba344584cc1ecd0b616
MD5 363dbc6954b7ae3ce5cdde0a8b72085e
SHA1 24e10e5826f5e7b85b1d06615c34498bf88bcf3d
SHA512 006fe8bbe106ebcb7b2df6f1cbb6497ba415d48b2b265cd0f77b9e86daf00f77da7da5dce01c6a40c3240a450091e452264a8657cd51925116d0d0b97348a3d5
SSDEEP 384:wVnH8+dN3jeDjBnsJg2KKFdpCftfwXKBgcXlTYYbP6XGjUR5:/+dNzeD98Pb1CxWc1TYYbSog
TLSH
T13E82E10E75FB97077DE64738604C54DD451AAFB67BD09570BC0AC70C14EE262AAE09C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BManager64.exe

Path C:\Users\Admin\AppData\Local\Temp\BManager64.exe
Size 546KB
SHA256 1d1d2245651632f1fce464eda9d5c5ea6ca43b4a04424601ce8c890951111028
MD5 c39a4cca58bedd9b3ceda4d0d3e1e94a
SHA1 0ea31e219e83aa4ba169ef2a132af8fb52f54bf4
SHA512 673794aee7f54a6a1191069a1647ff085c8da6c9bdcb8e358e9969c51c9782993c5e73b938bb4388af012a6cb279e1faf324af55c49748a85b8159c170f4252f
SSDEEP 3072:BBPlwpY3YKF0MrrJq+DNBg0DJtOJs9cAg0Fub+A5aiMqKIDqLqprqpB:rc2XFRJ3DNuzAOS9F4DqLqprqpB
TLSH
T199C43821B4C1E47AC862073008E9E6B57579FC215E72863F33F47F2F3B762816565AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C70ABC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\C70ABC2.tmp
Size 13.7MB
SHA256 c8f8cb8b58f44d0418c495a93852fa1b3401aa501aced43366bbc48cb7d49544
MD5 df695785a6d0a315726d2dd8f3965ac5
SHA1 96c65f1909013bc347971ea56deb0a27cdc23996
SHA512 dfbd2ed73fb82c1bde77c3df0488d616504950e38a605e7128a70ecfadcbda59c761cc2534fe1d53992f55b5c2f777cb034f6d375db47dbfabc8748aa66992ff
SSDEEP 393216:dBp5ZFgQ4qDelEuoTiPDwFmt2ycpwbGvu5Tw3eiL:np5QaXbANgAGG4N
TLSH
T12FE633C89639FA6A9DBA0DF34968C1D62A19DC79C474FAB3503FE344D93E87109109CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C70ABC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\C70ABC2.tmp
Size 13.7MB
SHA256 481ab51da77b3c15dbcdd2fce5580642427f91476787e2dc6377f64800976e86
MD5 a7e2b2df3e066ac2dcfac34a18164808
SHA1 96401109407b49d5e5bcbe3b4edfeffcc70a9d26
SHA512 6b7fc8adb1ae4b8ffc62228712ccc1fb54d8d7cd2d1325913b659e709654a34c35888e49a7fc0aca5f32d0025b0ccfb501c6f8beb4e6060721ec202294e48d1e
SSDEEP 393216:bB15ZFgQ4qDelEuoTiPDwFmt2ycpwbGvu5Tw3eiL:d15QaXbANgAGG4N
TLSH
T1C5E633C89639FA6A9DBA0DF34968C1D62A19DC79C474FAB3503FE344D92E87109109CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EA0C2B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\EA0C2B5.tmp
Size 5.1MB
SHA256 589af983f1dea3a909a5515af3a3a245223f4b50ae429e18db8f4be7e9619500
MD5 caccd9b74350f26455ebad33ff9c484f
SHA1 304a00b71863e1938a462c01722ef2bb626ef312
SHA512 1b1f4da5e171554104fe7c60d73f326c197c5dea98706689c60aa934a9ffdaa369ba1946a3532c95fc65a489debe6ecaf3ad3b4c14b9cb18d224d316ec46f9f3
SSDEEP 98304:v6SPLWtVjH857xcECK9rBDCUYlv1dadpzxCkBOXN4FyJXa06Oh7XF9YyBq:yBpH85yKPD9YR1da7xCu24FuphzF9TBq
TLSH
T159363385E61B6297D538339B60AD25CFFD3D2EF5D902A5C6175EAB7E702AC268C0420C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EA0C2B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\EA0C2B5.tmp
Size 5.1MB
SHA256 d61ba1dab569fed94571dbe9821e87a9ce5ccef2eb65317d53f1f9d4a0ea93b7
MD5 86594758810589ff269737f501af826a
SHA1 231c517ef73c0940083e1b5634d5329dc84de46a
SHA512 253eb4d9cfebedb11fbbb815a748df803ca2b9dfff41c9fad0bdaa23a0716f88f995a81f40dda9def6e2cb937c3b90035b7d42ba1881a2d9db8d204ca8e553ab
SSDEEP 98304:UYSPLWzVjH857xcECK9rBDCUYlv1dadpzxCkBOXN4FyJXa06Oh7XF9YyBq:3fpH85yKPD9YR1da7xCu24FuphzF9TBq
TLSH
T1EA363385E61B6297D538339B60AD25CFFD3D2EF5D902A5C6175EAB7E702AC268C0420C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ITransponder.exe

Path C:\Users\Admin\AppData\Local\Temp\ITransponder.exe
Size 1.6MB
SHA256 2570d1530ab4fd7b75d6ab905b5621ce5ed2ec0c5128295837b994c758d0ae25
MD5 7ce48dcb0a9fd2b98cefdcd11683ea03
SHA1 6b1eaa26d2596c9c5e99f9a0d2ea8e0295611b33
SHA512 159d9a7b1389272f42d53c1a064ff521d45430ba38231411aafc563c1d1dd9fb12a360a5630375ef1685045e193d1c0a524d4c810b88a69d9b9bd88d52fe6f18
SSDEEP 12288:Fkz7KHRu+LuwOnN0tRHFzHMoKdD/mn7Mg3qI70cr+h5A3L0Nsyk2:Fkz7Kxu+LuJuoLO7MO0cr+h5QoNsz
TLSH
T1CE753B203A29DA37E656A1F0497B5E1E0CADDD55077900D7D3F80E7D2DB0AF22B3264A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP120.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCP120.dll
Size 444KB
SHA256 0e535e147d253fc645ccb9406c888aee374ab1f3f9d99dc057a2b19cf401458b
MD5 854fb5751985d6d40fa12bc9c3e82be5
SHA1 e57cc61a59e88d2b6a373abca622af259c58be4e
SHA512 03c9e9886f20249547193351750fc5bd8b5f32e354162ca9be04d8a65a701d73d2ad86ede9606a38ba6e030f2a9c02efc60d409411991bbb636340f1c258c32a
SSDEEP 12288:UQHbDqy90l5yQBggQerjhUgiW6QR7t5ss3Ooc8DHkC2ehaxPe5:JbOqQbnrws3Ooc8DHkC2ehaxK
TLSH
T152A44B237B864CF1D19E53B231C9531257FAFC6541A1F303ABEEE1593FA6286E223611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCR100.dll
Size 756KB
SHA256 25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8
MD5 ef3e115c225588a680acf365158b2f4a
SHA1 ecda6d3b4642d2451817833b39248778e9c2cbb0
SHA512 d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a
SSDEEP 12288:amCy3y9cSWI5vMBEWL3XU8+n6ODOlMFgvXmteA5RLTDz7sHA9p++/pj:amCy3acqvM6WL3XU8+n6ODxgf4eUH7Tt
TLSH
T1D8F49E11B692C073C17221300629D7B25D7BB9711034A46BBBD99F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR120.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCR120.dll
Size 948KB
SHA256 82225ec7e2da43a7a72a3d523698747512523afa488767ca6839c63a7a5706fa
MD5 7dabb11da67d32c5dc917839fcbeb16d
SHA1 198923794549bc37e8b05a326a403eedadba7b55
SHA512 5e65b49ace7bffddeea1ad3c3aa777d6e23024b91b8bff3db1d1f4955d718d277e88428d671ce232807fc166818b891e8b0535b6aa4c21032dbc99840321fdd6
SSDEEP 24576:UmFyjHVMxBuwQLYucGp4iiqgNb3HopbiKJ:iMy2yRgFopbh
TLSH
T19D25AE12B982C0B2C57602B1152DE77219BFB971443684B7ABD98F0E1DB46C0FB67B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IntelliTrace.Profiler.dll

Path C:\Users\Admin\AppData\Local\Temp\Microsoft.IntelliTrace.Profiler.dll
Size 1.0MB
SHA256 811d7180d635a75d95a4e10eba6047c5f58532ecf48f3135f75fb4febf47a3eb
MD5 4bea6504751d2f357c0116425a24fb96
SHA1 f4734421095b85f09da8d9e85c29ee598c8b49ad
SHA512 c48022875405c656d8a4b02fb61c13d260bb1c2c33e41b3a295e271dccb4b38938a39790eee859de419dfed2498ed8abd5e224aedcfe6e1828ccdc8f76151051
SSDEEP 24576:PJpmbCdJLuP/8srf1SW9AuUjnbPoNkj+JYTfnrV7mS9V:PzSCG38Efn9AuwnbPoNkj+J6frV7mSz
TLSH
T127357B213641C43AE9AE02B02D7DF37E267DBEA92C70821777D8FA5D59B0411EB07A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc120.dll

Path C:\Users\Admin\AppData\Local\Temp\mfc120.dll
Size 4.2MB
SHA256 e7647532a382d3aa6a07fd45844d90fa29cd1d3905fdc893e7ac5d0063d09276
MD5 9015b3631e2054c1b29500375e92b0dd
SHA1 c0adf911530ced20d78216eec99e87466c36d24f
SHA512 3688f5f54d087b38f6346f972df89c80eb798a5bb25f1c5d17c134a81e5ddfacd2d1d4ffa8df3602fc5e23b7b8f34e799b693b6591efedb0d5044f2ff06fcc52
SSDEEP 98304:oehHn9mBz4+RlWsoa7/qdS0+xs82dGnbBuFLOAkGkzdnEVomFHKnP/08U:Cn6+xs82dGnduFLOyomFHKnP88U
TLSH
T1BC26BF02BFED80FAD66F13315E59773CA6EEAE94E830435722543F2EF9712026929117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 485KB
SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
TLSH
T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5360_318042206\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

socket64.sys

Path C:\Users\Admin\AppData\Local\Temp\socket64.sys
Size 7KB
SHA256 ef974bccc9078b809c87fcd0445f63f213c4ebaa33d7d3997b58d9be1b15e930
MD5 ca5e334a083e4546f957eb52cac0a1dc
SHA1 955f913b0be3ebc38edcc286edaa213728634558
SHA512 8907f5e533e41e4f5083fa804d11632968142b38cefdc95c648054ee3bcf3a475888174a2f8b6b976450cbf4235d282cc10c1ec3b1791669b96655f5a9662012
SSDEEP 192:Q6TTI4JMnI0hew1lAF+v2sZ6TdUzhDnJrJx2rmzqcE:RTTIqSkFqvZM6zbX22E
TLSH
T1D1F108CB1EB37D16C89DF9029A9F17804B847DCEAB557260389A982E7059B650404BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stencilclient.dat

Path C:\Users\Admin\AppData\Local\Temp\stencilclient.dat
Size 10.6MB
SHA256 44de4fdb12c056856930fbb69fdb9c10ed1a4c120dc0687e610f24d05bc92075
MD5 08f06544897daf51ef2f41b794d370b0
SHA1 1df7388d63d85d9cbbd54ccd1b6a3258474df3d9
SHA512 8f2aa14181d8448dd33799fb32c546006b51e7269cc4b7c289d53723fdb7e86cac6984d50f7db166407befff87f34c6f8ec9f4859d253a17a3940e9228f26180
SSDEEP 196608:p+TQ9cBEcbs/aoaYOSG4rWms6cpLABwDSVQ1aVKyAxue6+XciQE3mwa+Hvu78tH:KqibpUh6pFSVQ1aEQ2/T7PPF
TLSH
T10EB633DAC69C0700EA9BE7F6DB0D5DB27C926A1B08273706972045AB1CCB0ED555BF83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xerces-c_3_1.dll

Path C:\Users\Admin\AppData\Local\Temp\xerces-c_3_1.dll
Size 1.8MB
SHA256 3504d24b674f59508427a5aa2bcde8066993f9a183557e18053032e12902451c
MD5 ae3d0e5134f58cefa17b3108cc028ba4
SHA1 be653b8dd71c9c7ff08065e1d1cbf67a04033f72
SHA512 d27104aeecf06e7cfa3971cfb73cdc9c76a8757d2451b95ef163d93f4bc395865e1360e77c06d332fc07674cda4324faf85b944fac5af0bc8d43f8e263670ed4
SSDEEP 24576:V/vHDdxWEuv3uhYEI8Vibo1LYhbMSlkkNoZf:BP0u+EI8kUhYjHod
TLSH
T15E95F663BB96E066D292A2740CE6AF5450BDFF868470B306DECA033D84717B8155BB1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThreEngine32.exe

Path C:\Users\Admin\AppData\Local\ThreEngine32.exe
Size 492KB
SHA256 76c078bebcb9d93712063be28f7ba16615020f4f8ede8f70fed55985fcd270e1
MD5 a49e72b2505dc8dee942b0a39583675c
SHA1 1f21f1416f6fa8e0a0d5b2e7b1ac9df22d52c248
SHA512 12670de58c38168cf033cbf0822863a17076bb0670779b54ff29079a54a7ec1db9de188d4f9183bc7b6b46a4d9d003f6f6daacdd8064ef89091a31a0f454b86d
SSDEEP 12288:VpJVuIPG6LiEknQuqqQMhPMQawlzKoFqX/pkUewgyux:3PO+oneMhPMQawlzKoFA/pzzux
TLSH
T11BB4CFE1D389FCF5E05B01BA8C31D912255BF62D89B8096A242E71256A7378734FBD0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRClient.dll

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\TFWXNARCXFJGQV\CRClient.dll
Size 1.9MB
SHA256 e57152a250ed27ee106c415600f91731ce1c396212025dbab7387953241cc18b
MD5 0197fc30b7b88d1b3cea487e641b23db
SHA1 3401ac2ba5e05bfe192086e7c8d2512f48591f0a
SHA512 22fe7a9af66198b48edff7571c6f000ab0f42e2a3b0a30e578c2fb8f5d2349461c8b3b7918919d2b80632a64f51726330c9d45bc0d05b189b0e51e566e296ee6
SSDEEP 49152:oUJ9oFQdzj7Ybm858J4d1ayhwFnU1G0nEre4fZhVjbAP:o5bZ8J4d1DhwpUI0EreJP
TLSH
T1D7956C0763A901ACD5ABD3788A1B5A07E376780513759ECF039086A92F77BE15F3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SonicReflector.exe

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\TFWXNARCXFJGQV\SonicReflector.exe
Size 2.4MB
SHA256 6c4b6b6826186586b785409b1f163b1bcec59ca7540e3713aa58c3023aff0280
MD5 a9d73167ef04c480dfa730dfdade36ee
SHA1 afdd8f999d57ee7dd74796f0f688e53433cc000d
SHA512 2ecd3ff537837b70390ec78e8c911bce58749193a52fc137a69d243e306d962eee62e7c73bff375ec757822d5a06e4c499dc75690cef8ee7381ead06d49346e9
SSDEEP 49152:vFy3cSdUDKcL8h8ZI9dxquPYjOfNv2TWcWhynVxaD5D3TbCatr4VdKYU:vFhpbMN3yVxUwar4VdKl
TLSH
T11FC57C5762A801D5E1F6D13C8A67841BE6723C160731A6EF12B06A5E6F37BF04EBE710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\TFWXNARCXFJGQV\VCRUNTIME140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\TFWXNARCXFJGQV\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocol_dump.json

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\TFWXNARCXFJGQV\protocol_dump.json
Size 4.4MB
SHA256 7f402d4bff429725c6791b0390b8263b23dc61d2321313b0ee65edaace4610fb
MD5 dd32f5a87904c20257fac8e23f16ec33
SHA1 fc6556a388f41d5350ded7663b7de56680867925
SHA512 fc76ffc02146a0235801e1005b0a62d65f44b860cec03b05d916592d3b5a21a3e49a70f8f22b6e0187e86f46310319b0638c62e12126ff2123eeeb2400711232
SSDEEP 98304:IZSP7L0Xl/rayLn8T/PFAJWZJsTEBh37Y9dMhDC6GrzKVOxRt:I2s1uyLrJ2Z3EyDYzKVOxT
TLSH
T1B626232AD6976073F58AC4F758EE634E8D9A31901355E13A413A87DD81CBB43CA263CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandbox-impl.conf

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\TFWXNARCXFJGQV\sandbox-impl.conf
Size 35KB
SHA256 a8efe1b488cb9204e1d5803909b51f64ff752cdf90a419319095676cc100825f
MD5 fb973784fe0b283a0c68365f2b398471
SHA1 fc5f01d24de0393b2a0a8c9b594b8e4ecb0d1ba6
SHA512 2d461e5cd830dc45051c58f4f50598e07c99ab80eea2623821b870e6315e6d3d7c3b632f7dfb2bc34f37b99d5645c31bcbe33567073381459f53b6583c977084
SSDEEP 768:KaLS1GUeGs9bLN1VYV09ZC2ybYe66sCikwUoJRDJaotoXR2:/LS1gXJbVH9ZE8e8BUcDsotoB2
TLSH
T19AF26CE34F6B7B35784DB47AA039A4A3C264FDB1BE0D0071FC865507A4275D9A322DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\TFWXNARCXFJGQV\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\ms_ctrl_v1_0\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-149-0x00007FFE52B80000-0x00007FFE52DE3000-memory.dmp

Download

memory/1236-205-0x0000000074820000-0x0000000074872000-memory.dmp

Download

memory/2704-72-0x0000000074820000-0x0000000074872000-memory.dmp

Download

memory/2704-107-0x0000000074820000-0x0000000074872000-memory.dmp

Download

memory/2704-57-0x0000000074820000-0x0000000074872000-memory.dmp

Download

memory/2704-58-0x00007FFE52B80000-0x00007FFE52DE3000-memory.dmp

Download

memory/2704-59-0x0000000074840000-0x0000000074841000-memory.dmp

Download

memory/2704-61-0x0000000074820000-0x0000000074872000-memory.dmp

Download

memory/2704-63-0x0000000074820000-0x0000000074872000-memory.dmp

Download

memory/2704-66-0x0000000074820000-0x0000000074872000-memory.dmp

Download

memory/2704-99-0x0000000074820000-0x0000000074872000-memory.dmp

Download

memory/2704-69-0x0000000074820000-0x0000000074872000-memory.dmp

Download

memory/2704-62-0x0000000074820000-0x0000000074872000-memory.dmp

Download

memory/2704-85-0x0000000074820000-0x0000000074872000-memory.dmp

Download

memory/3888-125-0x00007FFE52B80000-0x00007FFE52DE3000-memory.dmp

Download

memory/3888-119-0x00000000013B0000-0x000000000176D000-memory.dmp

Download

memory/3888-132-0x00000000013B0000-0x000000000176D000-memory.dmp

Download

memory/3888-136-0x00000000013B0000-0x000000000176D000-memory.dmp

Download

memory/3888-155-0x00000000013B0000-0x000000000176D000-memory.dmp

Download

memory/3888-135-0x00000000013B0000-0x000000000176D000-memory.dmp

Download

memory/3888-117-0x00000000013B0000-0x000000000176D000-memory.dmp

Download

memory/4188-105-0x00007FFE4A3E0000-0x00007FFE4A443000-memory.dmp

Download

memory/4188-103-0x00007FFE4A3E0000-0x00007FFE4A443000-memory.dmp

Download

memory/4188-115-0x00007FFE4A3E0000-0x00007FFE4A443000-memory.dmp

Download

memory/4188-143-0x00007FF6D0880000-0x00007FF6D0AEF000-memory.dmp

Download

memory/4532-46-0x0000000073350000-0x00000000733A2000-memory.dmp

Download

memory/4532-47-0x00007FFE52B80000-0x00007FFE52DE3000-memory.dmp

Download

memory/5556-141-0x00007FFE52B80000-0x00007FFE52DE3000-memory.dmp

Download

memory/5832-157-0x00007FF7F9B00000-0x00007FF7F9D90000-memory.dmp

Download

memory/5832-130-0x00007FF7F9B00000-0x00007FF7F9D90000-memory.dmp

Download

memory/5832-153-0x00007FF7F9B00000-0x00007FF7F9D90000-memory.dmp

Download