hijackloader | 9ca59743ead4568f3c5e44613e3841d0d5c1dcd19bff9b66d126c72e61a564f9

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 5.7MB
Sample260930-ay6cmayt7m
SHA256 9ca59743ead4568f3c5e44613e3841d0d5c1dcd19bff9b66d126c72e61a564f9
MD5 474acc49dea3684e34e04362d96ba975
SHA1 5ea941382982e2e25c05b514666a04e47f735a20
SHA512 11f24844f95f6936ec1b80e76d901db739b4ce2ca3e90ed3c239e92ba027f2eebae4a20bf5aadf451b81c90b440049d01232ab7e4a9740bbf7fabc3a279b70bb
SSDEEP 98304:y95uRcYTT8Wwqc/LAtRgd6VAegyc0FDv1JRecXcYv2N6TbakzSTeWrPSkRAxIlmd:yuiY/8LlEtRgd6VAeO0BDjcAjSiWrPXW
TLSH
T14356330293C72034F0D55C35DC7744526F2BBC2A40F6E45A2CB9D41EA9BCAEAC9F67A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery hijackloader installer loader privilege_escalation spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\OnDemandOptimizer
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c475-44.dat	family_hijackloader

Executes dropped EXE 3 IoCs

pid	Process
4252	file.tmp
4816	LiDelt32.exe
2236	LiDelt32.exe

Loads dropped DLL 10 IoCs

pid	Process
4816	LiDelt32.exe
4816	LiDelt32.exe
4816	LiDelt32.exe
4816	LiDelt32.exe
2236	LiDelt32.exe
2236	LiDelt32.exe
2236	LiDelt32.exe
2236	LiDelt32.exe
5132	AdaptiveRo.exe
4632	Spec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\E:\	AdaptiveRo.exe
\??\F:\	AdaptiveRo.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2236 set thread context of 5132	2236	LiDelt32.exe	93
PID 5132 set thread context of 5708	5132	AdaptiveRo.exe	96
PID 2236 set thread context of 4632	2236	LiDelt32.exe	113
PID 5132 set thread context of 2608	5132	AdaptiveRo.exe	125
PID 5132 set thread context of 5708	5132	AdaptiveRo.exe	96
PID 5132 set thread context of 6032	5132	AdaptiveRo.exe	134

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	AdaptiveRo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	AdaptiveRo.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\FusionSourceSystems.job	Spec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AdaptiveRo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AdaptiveRo.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdaptiveRo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5448	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1252-0-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral2/memory/1252-39-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral2/memory/1252-63-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5132	AdaptiveRo.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4816	LiDelt32.exe
2236	LiDelt32.exe
2236	LiDelt32.exe
2236	LiDelt32.exe
2236	LiDelt32.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5708	chrome.exe
5708	chrome.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
4632	Spec.exe
4632	Spec.exe
4632	Spec.exe
4632	Spec.exe
4632	Spec.exe
4632	Spec.exe
4632	Spec.exe
4632	Spec.exe
4632	Spec.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe
5132	AdaptiveRo.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5132	AdaptiveRo.exe

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2236	LiDelt32.exe
2236	LiDelt32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeDebugPrivilege	5132	AdaptiveRo.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 4252	1252	file.exe	89
PID 4252 wrote to memory of 4816	4252	file.tmp	90
PID 4816 wrote to memory of 2236	4816	LiDelt32.exe	91
PID 2236 wrote to memory of 5132	2236	LiDelt32.exe	93
PID 2236 wrote to memory of 5132	2236	LiDelt32.exe	93
PID 5708 wrote to memory of 3364	5708	chrome.exe	97
PID 5708 wrote to memory of 5448	5708	chrome.exe	98
PID 5708 wrote to memory of 2644	5708	chrome.exe	100
PID 5708 wrote to memory of 2644	5708	chrome.exe	100
PID 5708 wrote to memory of 4364	5708	chrome.exe	99
PID 5708 wrote to memory of 4364	5708	chrome.exe	99
PID 5708 wrote to memory of 2664	5708	chrome.exe	102
PID 5708 wrote to memory of 2664	5708	chrome.exe	102
PID 5708 wrote to memory of 5744	5708	chrome.exe	103
PID 5708 wrote to memory of 5744	5708	chrome.exe	103
PID 5708 wrote to memory of 3224	5708	chrome.exe	104
PID 5708 wrote to memory of 3224	5708	chrome.exe	104
PID 5708 wrote to memory of 5880	5708	chrome.exe	105
PID 5708 wrote to memory of 5880	5708	chrome.exe	105
PID 2236 wrote to memory of 5132	2236	LiDelt32.exe	93
PID 5132 wrote to memory of 5708	5132	AdaptiveRo.exe	96
PID 5132 wrote to memory of 5708	5132	AdaptiveRo.exe	96
PID 5132 wrote to memory of 5708	5132	AdaptiveRo.exe	96
PID 5132 wrote to memory of 5708	5132	AdaptiveRo.exe	96
PID 5132 wrote to memory of 5708	5132	AdaptiveRo.exe	96
PID 5708 wrote to memory of 4084	5708	chrome.exe	106
PID 5708 wrote to memory of 5500	5708	chrome.exe	109
PID 5708 wrote to memory of 3508	5708	chrome.exe	108
PID 5708 wrote to memory of 5500	5708	chrome.exe	109
PID 5708 wrote to memory of 3508	5708	chrome.exe	108
PID 2236 wrote to memory of 4632	2236	LiDelt32.exe	113
PID 5708 wrote to memory of 2320	5708	chrome.exe	114
PID 5708 wrote to memory of 2320	5708	chrome.exe	114
PID 5708 wrote to memory of 5728	5708	chrome.exe	115
PID 5708 wrote to memory of 5728	5708	chrome.exe	115
PID 5708 wrote to memory of 5952	5708	chrome.exe	117
PID 5708 wrote to memory of 5852	5708	chrome.exe	116
PID 5708 wrote to memory of 5952	5708	chrome.exe	117
PID 5708 wrote to memory of 1196	5708	chrome.exe	118
PID 5708 wrote to memory of 5852	5708	chrome.exe	116
PID 5708 wrote to memory of 1196	5708	chrome.exe	118
PID 2236 wrote to memory of 4632	2236	LiDelt32.exe	113
PID 5708 wrote to memory of 1712	5708	chrome.exe	120
PID 5708 wrote to memory of 468	5708	chrome.exe	119
PID 5708 wrote to memory of 1712	5708	chrome.exe	120
PID 5708 wrote to memory of 1540	5708	chrome.exe	121
PID 5708 wrote to memory of 468	5708	chrome.exe	119
PID 5708 wrote to memory of 1540	5708	chrome.exe	121
PID 5708 wrote to memory of 5596	5708	chrome.exe	122
PID 5708 wrote to memory of 5596	5708	chrome.exe	122
PID 5708 wrote to memory of 852	5708	chrome.exe	123
PID 5708 wrote to memory of 5088	5708	chrome.exe	124
PID 5708 wrote to memory of 852	5708	chrome.exe	123
PID 5708 wrote to memory of 5088	5708	chrome.exe	124
PID 5132 wrote to memory of 2608	5132	AdaptiveRo.exe	125
PID 5132 wrote to memory of 2608	5132	AdaptiveRo.exe	125
PID 5132 wrote to memory of 2608	5132	AdaptiveRo.exe	125
PID 5132 wrote to memory of 2608	5132	AdaptiveRo.exe	125
PID 5132 wrote to memory of 2608	5132	AdaptiveRo.exe	125
PID 5132 wrote to memory of 2608	5132	AdaptiveRo.exe	125
PID 5132 wrote to memory of 5708	5132	AdaptiveRo.exe	96
PID 5132 wrote to memory of 5708	5132	AdaptiveRo.exe	96
PID 5132 wrote to memory of 5708	5132	AdaptiveRo.exe	96
PID 5132 wrote to memory of 5708	5132	AdaptiveRo.exe	96

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\is-K5RD2.tmp\file.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-K5RD2.tmp\file.tmp" /SL5="$4009E,5552778,121344,C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\LiDelt32.exe
    "C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\LiDelt32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\ProgramData\OnDemandOptimizer\LiDelt32.exe
      C:\ProgramData\OnDemandOptimizer\LiDelt32.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\AdaptiveRo.exe
        
        C:\Users\Admin\AppData\Local\Temp\AdaptiveRo.exe
        5⤵
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5132
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:2608
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Roaming\OnDemandOptimizer\Spec.exe
        
        C:\Users\Admin\AppData\Roaming\OnDemandOptimizer\Spec.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:1688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc07e9c728,0x7ffc07e9c734,0x7ffc07e9c740
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1900,i,17559685386376195712,46695812681660393,524288 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,8529771458661672075,6947084392095052220,262144 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,1373396211533021503,16180270520690275709,524288 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,16857056748634050073,4674977851369914009,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,9762394450684206668,631608058953449021,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4708,i,10222427959441280258,17760736231719509426,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,15004177648550014369,2098897802120423477,524288 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,9711759631181697210,5342705950904252382,524288 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5516,i,7651105246209951014,5410607869150552082,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5468,i,6223787734350160423,10126964848257096566,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5832,i,10296144568811684593,10415090580451826249,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,2632872668727482225,11095979705889308301,524288 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,18422029645094814145,5877946146427542155,524288 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5504,i,17702966793192713908,17740307050098867867,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5596,i,14888360587792895853,10175514337242459980,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6524,i,8508922004062135673,6345008539852206984,524288 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5528,i,4215974864886090360,1676069014723652268,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5796,i,3566765649598597357,15776658689032190093,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6624,i,1629629601747505176,5812032963573117771,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6616,i,4793638788830279234,13669031505491336716,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:9
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5592,i,1681755738662340713,255876248301776071,2097152 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4752,i,13129531007243068742,6464856056911270484,524288 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,14320546424958811093,5325372424844789220,524288 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,15616895285383700290,15870741503281327218,524288 --field-trial-handle=2068,i,1593953435083061216,10289684546540115519,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:4764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 6bfd26a37d5c2da21d55a59a8b874e606ddaac185a78ea73174df85651600065
MD5 f2ecbc0cda4c82f767cb595dd1f4ad65
SHA1 9c0df9d3417aa14120028ab2356f133b197467e7
SHA512 00e8fd3f92441c2baa3cb728bb2352ed919376e5f3794b3a7adaf4a3609bb604cdca2d3b94e13e79463add952b8314d45c1cd3c93c94fbcae072debe1c552eb2
SSDEEP 192:iRWACTv7VAPRp2GXsb+WNnPd0JA2jLuUkwxiyIsnAUgR:iRWACrkXlXwV0y2/ZUR
TLSH
T10522A52DAD64B53B9CDAD22AFA327753E7F5103134902E84E6F9893C21E79CC6227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 0a462964fc61e11adcbe9665bfff2aeed15b1082091c9fb36a71669145257bb0
MD5 e39cd6435683a3b7bddd9dafef224287
SHA1 dcef6fec1115819b7e1d16e439dcbbb2675ba6fe
SHA512 dae25f35912ea32c71a85b990477a838dcdc4e5ed345edbbc32559b876d6a1fa4bf0f2771aeed896e18918523bfedc67f3980f50903d67d5170a04bd3d2e3c09
SSDEEP 192:ens4K6fb7KxkXqK4I40pUZNCgVLHrKHfFKslESfFXzKD/wX+ErUkKN9W2AmtkoP9:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFe
TLSH
T18532FA17A48D9A3F4FD8D51DDC136F4FADB502567228092496FB9C0803F978E514A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f4a321727a7304a261495df26d153bd48f20bb19cd16efdbdf7155ead36c8dcf
MD5 ffd9b4288f92cd99266bc54bd687b2eb
SHA1 21f2aba33881ab7fa9ca8feb7fcbe94560efab67
SHA512 a6595f467138ab0382c0e5fa4ffc4aa88c9c40e24f1d595035ef395f59510d4aeee7d315d3dab5878b4cbd55061edd638a2552ad289a7a5279e8acc7d9a84661
TLSH
T14AA0025045C01412DE10F2F462E3465132529C1C1791531378D219C5AE5F7C4431D308
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad13c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5ad13c.TMP
Size 48B
SHA256 3bcebe4ec70bb915a7137b4bfeacc55033d8320d3143ff05869c804d3fe93c4c
MD5 eca8f50d7c50b2cedcba9cc13321a0a5
SHA1 951f4844fdaa6d053bbb9d394d29c0a41842e935
SHA512 fe9f1cd59be5c8ee40433ce616f071b0ebd5d136de662d32de676bfca2ae42cf3131234909faa4d9071ae1894dce546bc48c63f758552aa767e34f8046601a50
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 ae2b8895fbce880b4c930380d98303a10aa3244a892ede05425177bae959297e
MD5 a69d0194177f611282cfeae222ff0eab
SHA1 891d8c177992087f8c0a577be98c03a5a0decb97
SHA512 893921bbe61b4b1a7e9b3dfbd3d60cf35cd64c7413e6eaf378283c9001690cbaabf6dba1893b25ad99f45036c9900ffc2e12c20caea3391872497d9e7cdb4a0b
SSDEEP 3072:mcmHrYc8CuuOiti+o57j2R7PMGTrMc2yK:1Y0CzBo+XX9jK
TLSH
T1D3D31287DE8E7F45219B893D6907E5138AE740AF2155ABFF9D912D2D42CA4C98330D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 bb98113570a2d9ca5d918d78ab04c0617fc8fed26268c9fb9f1b54ed0503bd7f
MD5 ec42e6bd1c4ed294001f8f6fba5b3287
SHA1 0df475711b705472aa412538a57d4e9eb534dad5
SHA512 8d760f2f3735b6950d242473828e222fc28af87fb96ed66126b05279962381e73be14c4aa9a58c0d3d46f1aa4eee02795e9d1dc88c6e2c3b9ccf7329bdee62de
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5Ep0cDkB6vGyvtBWG0cj3bOv4a:CC0oWqNVVxi+9oP8DUDi0KIDeW9cj3bQ
TLSH
T167A13B31A87999B789F6D585B1462E53CF7830AB6521DFC4E8EE1D1C10B30DC0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 e2779066a776acaa2b3a2fcb67078a542ce0795cbdb672c435b13cf3a4d36f36
MD5 bc71ba7ed875de4da6c2946bedca64ed
SHA1 36178cf7f1c9849ac05cfde8c22bb2355d67b33b
SHA512 56c7a88010f0d993dd9cb399bf47f559d2bc0b1eb2dbf2ab5348269ba2b73fbaed1e8fcb4fcf0a74b0dcee930589e0193efdc4318dd70412fa397043ee9036d9
SSDEEP 3072:zcmHrYc8CuuOiti+o57j2R7PMGTrMc2yK:YY0CzBo+XX9jK
TLSH
T15BD31287DE8E7F45219B89396907E5134AE740AF2155ABFF9D912E2D42CA4C98330D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 f8d873650f53c70037ba23b474972f5999c62246d631b60c1fe97c0efc0d1d38
MD5 2c3dfc081cda781e1db7dc58b2d23be8
SHA1 83907815f0876dbe598bcad8eb79bc519bcf3883
SHA512 bade335ba21b05b713c25664f50338a1dea868ef3d98a01012922efb47162480468fc8e275cc3247222d13a15dcdff29060799224be3aa40a93693d1de08c86f
SSDEEP 3072:FcmHrYc8CuuOiti+o57j2R7PMGTrMc2yK:iY0CzBo+XX9jK
TLSH
T1DDD31287DE8E7F45209B89396907E5139AE740AF2155ABFF9D912E2D42CA4C98330D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

587BE16.tmp

Path C:\Users\Admin\AppData\Local\Temp\587BE16.tmp
Size 4.9MB
SHA256 52c00e9a2575c4219a0a8a8246800ee8b6306fa15b1b26b771c180572a3e49d7
MD5 382386b8059c6ba85b899a7bf08a7457
SHA1 ee088f63ad8552d970959d90b4394522729fbe52
SHA512 db23256dacc7b5f5ef866cfe4127aa2b303dc6085d794c1cf4c7b77c9002c5ad1aba16e14b9a76e1b0c8787c0fdc92a160999a42edae1d43174f882634e4d086
SSDEEP 98304:8qI8O2OYcaNVVuhbb67foD1dbBZpP7rCCSIrqD+YuI36av9Lfalc5:8F8IYnDuhi8dbBZpPOIrqD+YDvpZ5
TLSH
T1C1363318D8056C2CB1B0D414BB37B23F27A93F1E56C15EF27975C9DC9E460A6AFA04A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

587BE16.tmp

Path C:\Users\Admin\AppData\Local\Temp\587BE16.tmp
Size 4.9MB
SHA256 75ff3509360c9a80c3bf81458e752db0ea1263521c600ee4a9425fee15f40cfe
MD5 f9d6a7e182ea6224d8e480c6b15b6c3f
SHA1 34e26b0e2f9459c116e1f9bd7d8f19c828e7268b
SHA512 11cb185c3946264d7a530d12956efb29a7bc3c22498bbad1771b189d4468486dee5dbc1e8de8e9d56c9749a8d7f75adbcb1ad5bb7193190943f03cc838a728d8
SSDEEP 98304:2qIXO2OYcaNVVuhbb67foD1dbBZpP7rCCSIrqD+YuI36av9Lfalc5:2FXIYnDuhi8dbBZpPOIrqD+YDvpZ5
TLSH
T1C5363314D8056C2CB1B0D414BB37B23F27A93F1E56C15EF27975C9DC9E460A6AFA04A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9D6EB43.tmp

Path C:\Users\Admin\AppData\Local\Temp\9D6EB43.tmp
Size 40B
SHA256 d795b862aae1b40e7ecdf3b9e2fe0533a6969f1644e0b3032cf937ece0c48c3a
MD5 89140634687b0226589524e2c783ae8a
SHA1 2d9ceda070fe8b0cdbaef75f32b6c46b7d32eaa8
SHA512 89d923f2ac60adaec8e74758244de5e83d2124710b77e8e667d91ce838b4dabf5711bf7606473ff1a1bf74febeb4ad7f3ad71753c7c9d1f409ffe98bfd4e33b6
MD5 SHA1 SHA512

Submit Download

AdaptiveRo.exe

Path C:\Users\Admin\AppData\Local\Temp\AdaptiveRo.exe
Size 395KB
SHA256 2ec5b353892c64cb91007e37b8282f1f73a4661a6f1c4928999ee1e70cfba383
MD5 b22ccbb44972ea012679bde477c60b6b
SHA1 f72e3b8e0066459fbb60c513af30d8b6845045b1
SHA512 9b957b094dbf45fdd0b27056e7daf2f012d71ee461229b646395a09d07578bfe96f933f4896b8bc45e910fffa5671a99de41c6354366f7216cc867cc30193e16
SSDEEP 12288:WWN1UsKXK/CjIihe1ARLEKuoFKutUeJgZe0Qv:T6hg+rJwePv
TLSH
T153845C01F640D136D4C201BA56BA83B5AE78BE20171141D7F3DCEE6D6F269D0BA30B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LCGSl1x.7z

Path C:\Users\Admin\AppData\Local\Temp\LCGSl1x.7z
Size 18KB
SHA256 15ece7c50a7b4d978050a2093309bb1071e3723ccb026ed12e65547b669e3339
MD5 9c5d31ae155f949c16e03c0d827bfc40
SHA1 be10a2aede1f39afb7d6423da6f84a5316df2703
SHA512 6a6ec9a5bdd05faaf17d0bc2e44bc8fa5d89fdf8d2bef7b8a39aca41cc2f8bde6c3b914d447aae57ce6a2b9d7196fc6175bb1c27097a26c50ad13f4c5d09e5fa
SSDEEP 384:32WLCm7i5T40MMpyliyAVzOyyWDfURmtbTqINrDdqwkbh9:h9i5yAygwshTfpDdq99
TLSH
T14D92F18FD1DB439F834DA65D8ACA1B2600EB333C938A7848425C9D51FB5BC701749B4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CDLMSO.DLL

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\CDLMSO.DLL
Size 503KB
SHA256 1842dd86d089c0146a9122c50db5890101e9de27150a6056cb86466a3d8eb005
MD5 da00b56128fbf3fe9b96aad5d5c243e8
SHA1 063c58287ed4f3acfb7ed8611e86f5a20497b5c9
SHA512 05c990ba13d825cbb22040e8a2ac20edbbf94a37fe8e5417fe5fe4f2453624e599567ba36f91198dd909adf7923a9424e5659b607b86dec6c216ac8729f7b635
SSDEEP 6144:JFhyiq7Edg2aD5W+CCdq5NEKQpzaQGOtHIOfQ2mO8MBv7n3+ROl3DjehOyd5Gh8D:JFHqIqQCdhJzHFIYtRuxwIN
TLSH
T17FB4294EF7B549B7CA9FD139C8934D52FAF3F1814927970B1092876E3E23B81990AE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Graph.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\Graph.exe.manifest
Size 960B
SHA256 cfd354f78fa256b46a8642a96fe12b0de1b4d48ecb944c545f693f54bdbbd369
MD5 bb5088dbbae796a06c8c7869a70e6978
SHA1 f8f47edb7159226b43e73d8d12061be725e057c6
SHA512 879e316c6806d6bd525b5d4080dd3c2e122183fb4af07c6d54b8628c6e3a8381781bea104db3fa2e9ad28a1df2e94dad8e389bf887daee027cc0902aaa2e5168
TLSH
T1A2111082D018FA35DB0325D33DA2B12878BE672A0ACC46ECC8D15D7FA206ADD8281166
MD5 SHA1 SHA512 TLSH

Submit Download

LiDelt32.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\LiDelt32.exe
Size 293KB
SHA256 a5052164ae4d090e63dca24e3fd023cecee1edb2208bdc67f42c43dae5786899
MD5 d648e781dc62f145e7edfc7aad69761b
SHA1 d0b2adac924c53ea0c46126de63ef3effae0d8dd
SHA512 3aa4a058fca75c20b4dc0d421180755e6537f2279c3010d73c47576672ef33f5b83de9a58052fac4af170ab80f41db68a240a3be80dbc6c7414bee3cedc3de51
SSDEEP 3072:Ha0NHVYk5tOjhue2BsAD1QcuBgEccBWdO0Q2Knvd3nL4xB8mWdO0NWdO07sH:3NHhOj12BsU2clcB6BQVnhLbm6BN6BS
TLSH
T181544BC5B304C0E5EC578630846B8FA48BB2FE156D12271716A1BB5F9F336C2ED2652B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSOCF.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\MSOCF.dll
Size 216KB
SHA256 0c52ad64b64d08eebb0aef9fcf19c5218f4169938a2fe29896b6389ee18d8534
MD5 de4f187a14941870354037435eeffc91
SHA1 2c59139daf3666533b8cbe0206288341f1af9212
SHA512 82bdecfb032f8e56fe4952fd3eb6bbe71d941782b25e8da4e21e517991ddd0874fb94bbe2f3a836a194fb113ab901cc5371e6a6628da35e8b61972c7f050a652
SSDEEP 6144:Yfylp+W+J4xgG2UgnD8Jqv1pOlSGvvJd9IAd:YfKYWm4xgGQgT9IAd
TLSH
T1C224065AB3B484B2E166903888E7CF51F7B2B4921F34D74F12A2437E2F277A15D29316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OISAPP.DLL

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\OISAPP.DLL
Size 1.5MB
SHA256 30d2bf8c4025bb34cbcfaad0bfd5531715b05120d2454282285cb21d45a66dc0
MD5 c88646f31a8a64df5cdd168ba81b55ae
SHA1 c09eb8ea853112cb4e867e832d2356e89182fc30
SHA512 300b04ef5d593e3932bb0b005bdc68da55f6450dd83690566e1a5c1cb29786d9481d0a5c2a6a4f82ceef0c6f8b03e6a5b36f1f9fd5b59a95f32622a38daf7137
SSDEEP 24576:xCHMpa+Hvc53r/ezNjYl4Ex2My3ZsxrCSIpf0Olw02eSY8YqOAihKwqxAsn2aZTc:WV+Pc5IYeExjsd
TLSH
T12E65E95BB6384173E656907CCD67A9A2D2B3B0872C30571F0253C72E7F37792992A7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OISGRAPH.DLL

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\OISGRAPH.DLL
Size 354KB
SHA256 07ea9108c8e60608194463351f1afa863ff0fe8e88c5d5ed8f02622953636b20
MD5 203e5ade7c3cfca102a05a70b6d7e8de
SHA1 05dcf4c5887b0cd7d06c69e4c490822b184c7605
SHA512 ab8fb4440052acadb8d881e6c0309761e69551e22bde8c0551a5a3ee70d237b2cd30383bafc79369727892365debb27c4288f6c529fcacc2c179c2d980b749a0
SSDEEP 6144:F885PJpypqdHIbZjYUJnffbFIB7Luunxbvm++xgk+EnOf9lW+jHTlSGTSPYa8s7b:F55x/HwZ0U1bFIpuuxDm+Lk73di/m
TLSH
T1EA74292AF6648C73EA17D138D5636AE2E2B3F0456F20A35B4252873F5F7B7819D19320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ONENOTE.EXE.CONFIG

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\ONENOTE.EXE.CONFIG
Size 231B
SHA256 d5fc673281cd4a314539bf6f3fd73416609dcf7147a7f3580a20be7762ab1575
MD5 7b38bf9652107219fe2ba4e86f2b6d42
SHA1 f1522c24494336143a5ab25ab2553571b421d69e
SHA512 b5e6542fe8a9a0b1e0a37853605fd658da845f2dcaf07805d955667d0ccdaeb46dfc69c15c96a6ed583f4eb4ebf0608c29a61a76851fd05abd4932d22fbbe529
TLSH
T133D0A9084594FD2B1E331A233BA18982FF34B1E1A0684808B0AF3A230B220CE4793326
MD5 SHA1 SHA512 TLSH

Submit Download

OUTLOOK.EXE.MANIFEST

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\OUTLOOK.EXE.MANIFEST
Size 1KB
SHA256 5375e5a790d2911f4e665c06bfe1a225ee774ad84cd594b0f6e753daf98fe180
MD5 fdc42d3f5a5ad4fc3e0d51c61edf9d36
SHA1 7381a15f66ac469bab167dfe3e877f21f36ff09c
SHA512 18ed5572e69ca11f82fe3c900be96eb510ad9b8736e53e5ee613a07ecfa3f6e694e9cdb12a9fa0d9eb84bec5f012ed072493c88872856ab9b464a81b96ab2b77
TLSH
T1F421F1C1E018A679E70321E33D66F29464BF576E0DDC41BCD485997FA601ACA83831E2
MD5 SHA1 SHA512 TLSH

Submit Download

daemon-sec.xml

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\daemon-sec.xml
Size 20KB
SHA256 b9643d7f0eb2fec8bb5cf582827af5d151be17faa1acaff93c9c773815ca2322
MD5 b285d095dd369feb1d2c95eea1ed359d
SHA1 7efe69eac4adfc7e512b45fe5fbabc64e667d2fd
SHA512 89ae66f74108002685203509f5b052f845c59eb5f91d7bf31fe7a244f6f407d5db9784c3b5f1f0293d40ea40d3f8630ca6fa756e9d9ce168addb03ee6fd101bd
SSDEEP 384:zvgM7PlRj9A8N0UTvhgcEh2BRGeTVTLJO9QD7TNPA4lrUA8lqFbjujw+DC3veGCm:zvltRj9A8N0whgcEhUBI8Hld8wbjuPDq
TLSH
T103924CBBDB2B5A30E63A7857D91091E38E37E3F3760909509DD4880AE612CC7E169DC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

excel.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\excel.exe.manifest
Size 1KB
SHA256 bcb74f32e59fee1bb150d17d6f52faa283295580d63c9924cbb3a1eee441ab27
MD5 f9417bfab4a61da816ea880f01db86cb
SHA1 2e27075f50f2081c349a7a19d82a86951a85d0e7
SHA512 c2d92f32be6c205060e63eddee17f8cb30dd56a32a839101a81ecaad44cc0a0ca6510292c621a8f846dec9b62f94c0230de992b588fdbd166599bbf1911ebc3d
TLSH
T18221C1C1E008B675E70321D33C66F25464BF57AE0DDC41BCD4D5997FA605ADE83831A2
MD5 SHA1 SHA512 TLSH

Submit Download

msaccess.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\msaccess.exe.manifest
Size 1KB
SHA256 0be89a44e0fb87c932fde3ecc5dfccc42d6d8b49e54a0bdea851a463c1460512
MD5 6b61cf25c514f4df1f07af7fc41315e3
SHA1 fca6a6a9114218fe313686f5cbfd457088353c57
SHA512 4dbfd2e7c5b76bb2693bfb6ed0d017150d5b77a4ff27607d00e74ac140c7fa64bb3e83020e9b20276c9972721fb7786a2ae939d69b27a4422d47b35fc930078b
TLSH
T10321E6C2E054EA35E70311D37CE6B66474FE676A0DCC55B8D490987FA701ADA83831A7
MD5 SHA1 SHA512 TLSH

Submit Download

mspub.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\mspub.exe.manifest
Size 1KB
SHA256 83508e71cac8cab812798a6938b4b7770fad571478442fd1a6f31ffcb0b25977
MD5 702d6ccb361f9af1226fa791b669703b
SHA1 9277dd7fe24dc1b6dbe99b7f38468a562074c79d
SHA512 0b32636bb609fd0636143c01808234742fc938d0954d806177104b8eac74707c847872ee72bab5a2d24ec460a04dc7048d55e5310b428d634cf83c63e4231f79
TLSH
T1DD2121C2E008A679E70320E33866F25464BF676E0DDC41BCC481983FA201ACA83831E2
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\msvcp_win.dll
Size 621KB
SHA256 2a7825c2925347e0cb767a0dcb611f3eb80d0f71cbec981069b227bdc7cb871a
MD5 ec9f1cdd909f7c0bae4db21dcd2033de
SHA1 4c2a112e048fc75cd4c581836356e881552c9be2
SHA512 924022bb40c542a3ff0d09da35b8156113a83336d57924888d921f070f6192d83fcec6b89bde89957731e55e41118ca2affeb5885541bd345da7857996c22fd5
SSDEEP 12288:KXTCudddboDSf8I+YQtAww7ZQEKZm+jWodEEVM6LZWPn:KXTC/Sf8IdQKQEKZm+jWodEEq6LZWf
TLSH
T1F9D42A26BB4D06B0D166A3BCA1C38706D7F1BC154722A3C7429BE26D1F6B7C56B3B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr90.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\msvcr90.dll
Size 629KB
SHA256 e88299ea1a140ff758163dfff179fff3bc5e90e7cfbbd178d0c886dbad184012
MD5 552cf56353af11ce8e0d10ee12fdcd85
SHA1 6ab062b709f851a9576685fe0410ff9f1a4af670
SHA512 122f389e7047b728b27f3c964d34b9c8bcae7c36177122e6aa997a6edadad20b14552879f60667a084d34727cb2c85dd5534b6fa7a451f0ab33555b315335457
SSDEEP 12288:BD6NCL00fQwUX9iOv2ME0cbejlzKaswsmqy7oh41oZ:l2CLFffUNiK20yejFsZmqy7ohOW
TLSH
T1F6D48C65F3AA06B6D427C13DCED251A6F6727819432457EB02918F685B27BF09B3B303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powerpnt.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\powerpnt.exe.manifest
Size 3KB
SHA256 1967d424f2453a820184c0b8f89bc55c8f2cc30ffc92f5b3fdc035f1c017d581
MD5 6ce291375ae82a05ef1177e3192ee244
SHA1 06c3d7c2433cb6a3f9862a9d73f66714afae1287
SHA512 96d3ec5ce08af57d57f93724c785eb5aa8aee0e1c9d0a079218ce9571107aeca3623a506b6a4f9fe2a2dc0f3bcff64314667860b1ac49f498155b7def8d9d421
TLSH
T1CC7100408404F3D89D9609D17FA1D778D4CFAB8CC58A0CBC64B6EEAECB78441D9D62DA
MD5 SHA1 SHA512 TLSH

Submit Download

sandboxio.map

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\sandboxio.map
Size 4.4MB
SHA256 7b47a0e5153395d8d6c4b1202ce26a7d284dfbe6d73e60308dc82f69b027f9ee
MD5 6f3b9aebd1d5d87ea67cef25487172ea
SHA1 c2dfbe649eb8e65b4b7ae7345c4aa2ef71d2ecd3
SHA512 93bb9f5f3ca10661b509c036838db1b679ccce9b7599183027bcc728f72864975b442725082bfb1d991526caf06cd9513437b1e6542450726dcd5e2c6125d9a0
SSDEEP 98304:LGJDTsUSTGRr4gC5rtWYW/8MRTLCAnLi7qCrZKTl:qJDTs3TGRrTC5xXW/XRTOFZKTl
TLSH
T1F12623BEFC850C32C8777060D2DEE9D844B2F6E5AD89D8241541BCE399642987B9FED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5RGUB.tmp\ucrtbase.dll
Size 1021KB
SHA256 3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
MD5 4e326feeb3ebf1e3eb21eeb224345727
SHA1 f156a272dbc6695cc170b6091ef8cd41db7ba040
SHA512 be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67
SSDEEP 24576:L1foGwlaDT22+Pk+j2ZXCE6cctEMmxvSZX0ypCD3:JfoBR2+PfXWrT
TLSH
T1F725AF64FA5C0AA5D57BE17CC95B550ED5B2780207708ACF03EA4BBD2E2BBD91637320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-K5RD2.tmp\file.tmp
Size 1.1MB
SHA256 8f0beb5863d190b7b2cfe7f506f3b721ab6b9e892337a133364f2ba710931b25
MD5 be3cc5717f5951662adb399d613f20cc
SHA1 f776bc4344ad59fbd6950d24d3aa6dddb3df215a
SHA512 fbe0aab2194e4f09cbdbed770d862a4f9f2672a5c8346ee7e392341973c75cfc0b8c66a132e5a2bb22fb6e265cb40b45dfb05fb076c74914faed35e1e476a2cd
SSDEEP 24576:wnbbPImgK4brDi4IxgRqzwqNb+Yz71P2EN29cnDdqxyt:GHeKh4nqzF1Px2io
TLSH
T10C453A22A3D28437D5732E759D6BD2946C367E202EB4E44A7EF89E0C0E35B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5708_1017460242\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Spec.exe

Path C:\Users\Admin\AppData\Roaming\OnDemandOptimizer\Spec.exe
Size 144KB
SHA256 f99c12933c36ac9b9d33340145434a7d68f1688a7805ca325379a4b927521c99
MD5 7aa9b25a26dea6c18eb6f12bd12fb3b0
SHA1 c733f9e98bed9bde335bb36efedfb2010132e050
SHA512 cadff10f1e31103e443102ff950df5cb586372933899de6e50b83033ae55407f41ed9169c819b7cbcd71190fb960d3d916002312e5836594eadfa54dd84b36c2
SSDEEP 3072:zxxPGrlqO+NDWQ+WMqoQpFWzqSlxmW6PrbFSr:FUrrQ+WMMFWzqSnsXFa
TLSH
T1EBE3D08127703805DE524E31A4E4DB383A3C7D45AF0089BB325BF78F9B73781B95A269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-63-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1252-39-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1252-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2236-66-0x00007FFC253A0000-0x00007FFC25403000-memory.dmp

Download

memory/2236-70-0x00007FFC253A0000-0x00007FFC25403000-memory.dmp

Download

memory/2236-64-0x00007FFC253A0000-0x00007FFC25403000-memory.dmp

Download

memory/2236-61-0x00007FFC21EC0000-0x00007FFC21EF9000-memory.dmp

Download

memory/2236-82-0x00007FF60CB80000-0x00007FF60CBCC000-memory.dmp

Download

memory/4252-38-0x0000000002560000-0x0000000002561000-memory.dmp

Download

memory/4252-62-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/4252-40-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/4252-6-0x0000000002560000-0x0000000002561000-memory.dmp

Download

memory/4632-293-0x00007FFC2DA40000-0x00007FFC2DCA3000-memory.dmp

Download

memory/4632-557-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4632-554-0x00000000742C0000-0x0000000074312000-memory.dmp

Download

memory/4632-290-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4816-45-0x00007FFC13F60000-0x00007FFC13FC3000-memory.dmp

Download

memory/4816-37-0x00007FFC21EE0000-0x00007FFC21EE1000-memory.dmp

Download

memory/5132-151-0x0000000001100000-0x00000000014BC000-memory.dmp

Download

memory/5132-72-0x0000000001100000-0x00000000014BC000-memory.dmp

Download

memory/5132-81-0x0000000001100000-0x00000000014BC000-memory.dmp

Download

memory/5132-80-0x00007FFC2DA40000-0x00007FFC2DCA3000-memory.dmp

Download

memory/5132-83-0x0000000001100000-0x00000000014BC000-memory.dmp

Download

memory/5132-84-0x0000000001100000-0x00000000014BC000-memory.dmp

Download

memory/5132-74-0x0000000001100000-0x00000000014BC000-memory.dmp

Download

memory/5132-87-0x0000000001100000-0x00000000014BC000-memory.dmp

Download