a281d0d4c3487fb2c9f1f1356c790734f6040ffa681682fbdd3ad70f35dc332b

Analysis

user interaction
yes
max time kernel
594s
max time network
584s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Intip-Setup-0.3.0-beta.1.exe
Size 93.9MB
Sample261027-dpdsss1tdt
SHA256 a281d0d4c3487fb2c9f1f1356c790734f6040ffa681682fbdd3ad70f35dc332b
MD5 bd8c5e02a55c515c485a6b9b0c5db69e
SHA1 ed3d3b660401a6a141bf98b823e53dfe6703ebab
SHA512 2af8e2c28676f67b2bb084dd95690ad93df82c1b53648539f32ae26b2716b44b8444fc3691fed44bfb56e4d0020860e27be890cabf721f2e6070b5fe41239b97
SSDEEP 1572864:U6VfWox15zUIdzclE50cqDIdpCpSKBvqcPoYzYNm591aVubpqY4r1LVqH1n8+u4l:U6BZxNtP5buOCpB+8v3tqYQ1oi+u4Io
TLSH
T1222833BC6AE166DBCD917A7586BC5B438DAE7B7A144470F28C49037C2780AA758FF0C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
4904	Intip.exe
1220	Intip.exe
5216	Intip.exe
2852	intip-helper.exe
1312	Intip.exe
2684	Intip.exe
1052	Intip.exe

Loads dropped DLL 17 IoCs

pid	Process
3668	Intip-Setup-0.3.0-beta.1.exe
3668	Intip-Setup-0.3.0-beta.1.exe
3668	Intip-Setup-0.3.0-beta.1.exe
3668	Intip-Setup-0.3.0-beta.1.exe
3668	Intip-Setup-0.3.0-beta.1.exe
3668	Intip-Setup-0.3.0-beta.1.exe
3668	Intip-Setup-0.3.0-beta.1.exe
3668	Intip-Setup-0.3.0-beta.1.exe
3668	Intip-Setup-0.3.0-beta.1.exe
3668	Intip-Setup-0.3.0-beta.1.exe
4904	Intip.exe
1220	Intip.exe
1220	Intip.exe
5216	Intip.exe
1312	Intip.exe
1312	Intip.exe
2684	Intip.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intip = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Intip\\Intip.exe\""	Intip.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1312	Intip.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2756	powershell.exe
2076	powershell.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\scoped_dir4904_1016639949\image.ico	Intip.exe
File created	C:\Windows\SystemTemp\scoped_dir4904_1518541370\image.ico	Intip.exe
File created	C:\Windows\SystemTemp\scoped_dir4904_912330256\image.ico	Intip.exe
File created	C:\Windows\SystemTemp\scoped_dir4904_844478685\image.ico	Intip.exe
File created	C:\Windows\SystemTemp\scoped_dir4904_1737149886\image.ico	Intip.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5928	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	intip-helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Intip.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Intip.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Intip.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Intip.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	intip-helper.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Intip-Setup-0.3.0-beta.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Intip.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Intip.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Intip.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Intip.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5928	powershell.exe
5928	powershell.exe
2756	powershell.exe
2756	powershell.exe
3668	Intip-Setup-0.3.0-beta.1.exe
3668	Intip-Setup-0.3.0-beta.1.exe
2076	powershell.exe
2076	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
1312	Intip.exe
1312	Intip.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4904	Intip.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5928	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeIncreaseQuotaPrivilege	2076	powershell.exe
Token: SeSecurityPrivilege	2076	powershell.exe
Token: SeTakeOwnershipPrivilege	2076	powershell.exe
Token: SeLoadDriverPrivilege	2076	powershell.exe
Token: SeSystemProfilePrivilege	2076	powershell.exe
Token: SeSystemtimePrivilege	2076	powershell.exe
Token: SeProfSingleProcessPrivilege	2076	powershell.exe
Token: SeIncBasePriorityPrivilege	2076	powershell.exe
Token: SeCreatePagefilePrivilege	2076	powershell.exe
Token: SeBackupPrivilege	2076	powershell.exe
Token: SeRestorePrivilege	2076	powershell.exe
Token: SeShutdownPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeSystemEnvironmentPrivilege	2076	powershell.exe
Token: SeRemoteShutdownPrivilege	2076	powershell.exe
Token: SeUndockPrivilege	2076	powershell.exe
Token: SeManageVolumePrivilege	2076	powershell.exe
Token: 33	2076	powershell.exe
Token: 34	2076	powershell.exe
Token: 35	2076	powershell.exe
Token: 36	2076	powershell.exe
Token: SeSecurityPrivilege	3668	Intip-Setup-0.3.0-beta.1.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe
Token: SeShutdownPrivilege	4904	Intip.exe
Token: SeCreatePagefilePrivilege	4904	Intip.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4904	Intip.exe
2252	PickerHost.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe
4904	Intip.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 5928	3668	Intip-Setup-0.3.0-beta.1.exe	89
PID 3668 wrote to memory of 2756	3668	Intip-Setup-0.3.0-beta.1.exe	91
PID 3668 wrote to memory of 2076	3668	Intip-Setup-0.3.0-beta.1.exe	93
PID 4904 wrote to memory of 1220	4904	Intip.exe	97
PID 4904 wrote to memory of 5216	4904	Intip.exe	98
PID 4904 wrote to memory of 2852	4904	Intip.exe	99
PID 4904 wrote to memory of 1216	4904	Intip.exe	100
PID 4904 wrote to memory of 5188	4904	Intip.exe	103
PID 4904 wrote to memory of 3984	4904	Intip.exe	105
PID 4904 wrote to memory of 4292	4904	Intip.exe	110
PID 4904 wrote to memory of 6076	4904	Intip.exe	112
PID 4904 wrote to memory of 4308	4904	Intip.exe	114
PID 4904 wrote to memory of 672	4904	Intip.exe	116
PID 4904 wrote to memory of 4760	4904	Intip.exe	121
PID 4904 wrote to memory of 4992	4904	Intip.exe	123
PID 4904 wrote to memory of 2152	4904	Intip.exe	125
PID 4904 wrote to memory of 1312	4904	Intip.exe	127
PID 2684 wrote to memory of 1052	2684	Intip.exe	130
PID 4904 wrote to memory of 1996	4904	Intip.exe	131
PID 4904 wrote to memory of 1920	4904	Intip.exe	133
PID 4904 wrote to memory of 3612	4904	Intip.exe	135

C:\Users\Admin\AppData\Local\Temp\Intip-Setup-0.3.0-beta.1.exe
"C:\Users\Admin\AppData\Local\Temp\Intip-Setup-0.3.0-beta.1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5928
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Intip', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2076

C:\Users\Admin\AppData\Local\Programs\Intip\Intip.exe
"C:\Users\Admin\AppData\Local\Programs\Intip\Intip.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Programs\Intip\Intip.exe
  "C:\Users\Admin\AppData\Local\Programs\Intip\Intip.exe" --type=gpu-process --gpu-recent-crash-count=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Intip" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1808,i,5754747326706714706,4743736050714615386,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,NetworkServiceInProcess2,PdfUseShowSaveFilePicker --disable-features=AudioServiceOutOfProcess,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,12705853710390873374,15697112631005868531,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1220
- C:\Users\Admin\AppData\Local\Programs\Intip\Intip.exe
  "C:\Users\Admin\AppData\Local\Programs\Intip\Intip.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Intip" --app-user-model-id=id.awal.intip --app-path="C:\Users\Admin\AppData\Local\Programs\Intip\resources\app.asar" --enable-sandbox --allow-file-access-from-files --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --launch-time-ticks=684331367 --field-trial-handle=1808,i,5754747326706714706,4743736050714615386,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,NetworkServiceInProcess2,PdfUseShowSaveFilePicker --disable-features=AudioServiceOutOfProcess,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,12705853710390873374,15697112631005868531,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2628 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5216
- C:\Users\Admin\AppData\Local\Programs\Intip\resources\app.asar.unpacked\helper\intip-helper.exe
  C:\Users\Admin\AppData\Local\Programs\Intip\resources\app.asar.unpacked\helper\intip-helper.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:2852
- C:\Windows\system32\reg.exe
  reg query "HKCU\Control Panel\Colors" /v Background
  2⤵
  PID:1216
- C:\Windows\system32\reg.exe
  reg query "HKCU\Control Panel\Desktop" /v TileWallpaper
  2⤵
  PID:5188
- C:\Windows\system32\reg.exe
  reg query "HKCU\Control Panel\Desktop" /v WallpaperStyle
  2⤵
  PID:3984
- C:\Windows\system32\reg.exe
  reg query "HKCU\Control Panel\Colors" /v Background
  2⤵
  PID:4292
- C:\Windows\system32\reg.exe
  reg query "HKCU\Control Panel\Desktop" /v TileWallpaper
  2⤵
  PID:6076
- C:\Windows\system32\reg.exe
  reg query "HKCU\Control Panel\Desktop" /v WallpaperStyle
  2⤵
  PID:4308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand IwAgAEQAYQBmAHQAYQByACAAYQBwAGwAaQBrAGEAcwBpACAAZABpACAAbQBlAG4AdQAgAFMAdABhAHIAdAAgAFcAaQBuAGQAbwB3AHMAIAB1AG4AdAB1AGsAIABwAGUAbgBjAGEAcgBpAGEAbgAgAGQAaQAgAFMAdABhAHIAdAAgAEkAbgB0AGkAcAAgACgAbQBhAGkAbgAuAGoAcwApAC4ACgAjACAASwBlAGwAdQBhAHIAYQBuACAASgBTAE8ATgA6ACAAWwB7ACAAbgA6ACAAbgBhAG0AYQAsACAAYQA6ACAAQQBwAHAASQBEACwAIABsADoAIABsAG8AZwBvACAAUABOAEcAIAAoAGEAcABsAGkAawBhAHMAaQAgAFMAdABvAHIAZQApACAAfQBdAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdABwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgACgAKACMAIABsAG8AawBhAHMAaQAgAHQAaQBhAHAAIABwAGEAawBlAHQAIABhAHAAbABpAGsAYQBzAGkAIABTAHQAbwByAGUACgAkAHAAawBnACAAPQAgAEAAewB9AAoARwBlAHQALQBBAHAAcAB4AFAAYQBjAGsAYQBnAGUAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAcABrAGcAWwAkAF8ALgBQAGEAYwBrAGEAZwBlAEYAYQBtAGkAbAB5AE4AYQBtAGUAXQAgAD0AIAAkAF8ALgBJAG4AcwB0AGEAbABsAEwAbwBjAGEAdABpAG8AbgAgAH0ACgAKACMAIABsAG8AZwBvACAANAA0AHgANAA0ACAAZABhAHIAaQAgAG0AYQBuAGkAZgBlAHMAdAAgAHAAYQBrAGUAdAA7ACAAZABpAHAAaQBsAGkAaAAgAHYAYQByAGkAYQBuACAAYgBlAHIAdwBhAHIAbgBhACAAeQBhAG4AZwAgAHAAYQBsAGkAbgBnACAAcABhAHMAIAB1AG4AdAB1AGsAIABpAGsAbwBuACAANAA4AHAAeAAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0ATABvAGcAbwAoACQAZgBhAG0AaQBsAHkALAAgACQAYQBwAHAASQBkACkAIAB7AAoAIAAgACQAbABvAGMAIAA9ACAAJABwAGsAZwBbACQAZgBhAG0AaQBsAHkAXQAKACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAGwAbwBjACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACQAbQBhAG4AaQBmAGUAcwB0ACAAPQAgAFsAeABtAGwAXQAoAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUgBhAHcAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGwAbwBjACAAJwBBAHAAcAB4AE0AYQBuAGkAZgBlAHMAdAAuAHgAbQBsACcAKQApAAoAIAAgACQAYQBwAHAAIAA9ACAAJABtAGEAbgBpAGYAZQBzAHQALgBQAGEAYwBrAGEAZwBlAC4AQQBwAHAAbABpAGMAYQB0AGkAbwBuAHMALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ASQBkACAALQBlAHEAIAAkAGEAcABwAEkAZAAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAkAHIAZQBsACAAPQAgACQAYQBwAHAALgBWAGkAcwB1AGEAbABFAGwAZQBtAGUAbgB0AHMALgBTAHEAdQBhAHIAZQA0ADQAeAA0ADQATABvAGcAbwAKACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAHIAZQBsACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACQAYgBhAHMAZQAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAbABvAGMAIAAkAHIAZQBsAAoAIAAgACQAZABpAHIAIAA9ACAAUwBwAGwAaQB0AC0AUABhAHQAaAAgACQAYgBhAHMAZQAKACAAIAAkAHMAdABlAG0AIAA9ACAAWwBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AEYAaQBsAGUATgBhAG0AZQBXAGkAdABoAG8AdQB0AEUAeAB0AGUAbgBzAGkAbwBuACgAJABiAGEAcwBlACkACgAgACAAJABmAGkAbABlAHMAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABkAGkAcgAgAC0ARgBpAGwAdABlAHIAIAAiACQAcwB0AGUAbQAqAC4AcABuAGcAIgAKACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAHcAYQBuAHQAIABpAG4AIAAnAHQAYQByAGcAZQB0AHMAaQB6AGUALQA0ADgAXwBhAGwAdABmAG8AcgBtAC0AdQBuAHAAbABhAHQAZQBkACcALAAgACcAdABhAHIAZwBlAHQAcwBpAHoAZQAtADQAOABfAGEAbAB0AGYAbwByAG0ALQBsAGkAZwBoAHQAdQBuAHAAbABhAHQAZQBkACcALAAgACcAdABhAHIAZwBlAHQAcwBpAHoAZQAtADYANABfAGEAbAB0AGYAbwByAG0ALQB1AG4AcABsAGEAdABlAGQAJwAsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACcAdABhAHIAZwBlAHQAcwBpAHoAZQAtADQAOAAnACwAIAAnAHMAYwBhAGwAZQAtADIAMAAwACcALAAgACcAcwBjAGEAbABlAC0AMQA1ADAAJwAsACAAJwBzAGMAYQBsAGUALQAxADAAMAAnACkAIAB7AAoAIAAgACAAIAAkAGYAIAA9ACAAJABmAGkAbABlAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATgBhAG0AZQAgAC0AbABpAGsAZQAgACIAKgAkAHcAYQBuAHQALgBwAG4AZwAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoAIAAgACAAIABpAGYAIAAoACQAZgApACAAewAgAHIAZQB0AHUAcgBuACAAJABmAC4ARgB1AGwAbABOAGEAbQBlACAAfQAKACAAIAB9AAoAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAYgBhAHMAZQApACAAewAgAHIAZQB0AHUAcgBuACAAJABiAGEAcwBlACAAfQAKACAAIAByAGUAdAB1AHIAbgAgACgAJABmAGkAbABlAHMAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAC4ARgB1AGwAbABOAGEAbQBlAAoAfQAKAAoAJABvAHUAdAAgAD0AIABmAG8AcgBlAGEAYwBoACAAKAAkAGEAIABpAG4AIABHAGUAdAAtAFMAdABhAHIAdABBAHAAcABzACkAIAB7AAoAIAAgAGkAZgAgACgAJABhAC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwB1AG4AaQBuAHMAdABhAGwAbAB8AGgAYQBwAHUAcwAgAGkAbgBzAHQAYQBsACcAKQAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9AAoAIAAgACQAbABvAGcAbwAgAD0AIAAkAG4AdQBsAGwACgAgACAAaQBmACAAKAAkAGEALgBBAHAAcABJAEQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAC4AKwA/ACkAIQAoAC4AKwApACQAJwApACAAewAgACQAbABvAGcAbwAgAD0AIABHAGUAdAAtAEwAbwBnAG8AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAAkAE0AYQB0AGMAaABlAHMAWwAyAF0AIAB9AAoAIAAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7ACAAbgAgAD0AIAAkAGEALgBOAGEAbQBlADsAIABhACAAPQAgACQAYQAuAEEAcABwAEkARAA7ACAAbAAgAD0AIAAkAGwAbwBnAG8AIAB9AAoAfQAKAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAQAAoACQAbwB1AHQAKQAgAC0AQwBvAG0AcAByAGUAcwBzAAoA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- C:\Windows\system32\reg.exe
  reg query "HKCU\Control Panel\Colors" /v Background
  2⤵
  PID:4760
- C:\Windows\system32\reg.exe
  reg query "HKCU\Control Panel\Desktop" /v TileWallpaper
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg query "HKCU\Control Panel\Desktop" /v WallpaperStyle
  2⤵
  PID:2152
- C:\Users\Admin\AppData\Local\Programs\Intip\Intip.exe
  "C:\Users\Admin\AppData\Local\Programs\Intip\Intip.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Intip" --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1808,i,5754747326706714706,4743736050714615386,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,NetworkServiceInProcess2,PdfUseShowSaveFilePicker --disable-features=AudioServiceOutOfProcess,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,12705853710390873374,15697112631005868531,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=4776 /prefetch:10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1312
- C:\Windows\system32\reg.exe
  reg.exe query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings
  2⤵
  PID:1996
- C:\Windows\system32\reg.exe
  reg.exe query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings /s /v ShowBanner
  2⤵
  PID:1920
- C:\Windows\system32\reg.exe
  reg.exe query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings /s /v ShowInActionCenter
  2⤵
  PID:3612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s ConsentUxUserSvc
1⤵
PID:2036

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4628

C:\Users\Admin\AppData\Local\Programs\Intip\Intip.exe
"C:\Users\Admin\AppData\Local\Programs\Intip\Intip.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Programs\Intip\Intip.exe
  "C:\Users\Admin\AppData\Local\Programs\Intip\Intip.exe" --type=gpu-process --gpu-recent-crash-count=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Intip" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1948,i,1715831895057000131,10813400599192316374,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,NetworkServiceInProcess2,PdfUseShowSaveFilePicker --disable-features=AudioServiceOutOfProcess,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1952,i,7209233959835696279,13875549545839162606,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  - Executes dropped EXE
  PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 6c9967d3fdffedbc1faa25249c2b89efcf4f6ba35a9698c75e53d5f8b220b827
MD5 eb60d0755502ef668f7350d1d80f42ca
SHA1 2425b5d43f6ee1e2a319356bb3465ab6192b99f6
SHA512 2f23bafe1029447b9c41bce27511eb0c5bd000c0fcae5d4e6bc8e60cb92393173d5422c4a2894ca9facd5da1f49ac3d32d0f81726bdc50548f77e3d43c93ba03
SSDEEP 384:D1eBaGH1i+aflbP+VnvmC5+uelgh3WOEPiUDzdC0AIAgTXF4gl968hdGloDqBDKq:RenVZclz+VvT5+q4N6UFC0AIAgJdl9t0
TLSH
T13282D928226F99C7DC5130F414900B4EE7F4D096A7E191DABB5FCE1BEC50A7D8A911F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 cfd58afd027633d7bf989a91aee137613ec934039e62f6b65c8edb52e47646ad
MD5 8fbb8a4c06ebcb809500d8b14155e812
SHA1 46078dbc676426073ccf4ab1db0b3c13bd09dc78
SHA512 d5909bbec217ed7b6dca40c6a71c3be7f19e001ccecb139b1ab0ebe4a14b692910a5caadd9b4c2b2c31ed2c14c7bcb5ae8e4cfa1b1f8f1df24cbe4e0f09661c4
SSDEEP 384:d1eBaGH1i8GW14bFxoMoAMJI+gvvrr2PndIAsF41h48WM+jd7yErbfkws8hf9:3enVGWixeMTr+c61IAcCh4M+gIbf1sA9
TLSH
T1D47287A9616F6DC7D89122B010D601E7FBA4E08CDF7551D8FE2BC92B5C90FB65FA0520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 d6d726123de86cf9ea820a9cb1c89f2da297742aee01846eea20019627bb74a3
MD5 ebbb294830cda55597e90b0cd0d52034
SHA1 ece7549fa12ce4773d0a233a1385abbf617c55fc
SHA512 821a4c344d262c2f8c5f8eb4d637af49bdb5ef6646e09740b58cda6cf0b90c4433c5cb020941aa17cab447adf1e719810b1a6106ef06f9218748592bfe10cd8d
SSDEEP 384:WSEgnT1iBNibPserM/+XY0rr2VWOE6UDzdC0AIACXF4oiNAAJdxBDKV5e+IbWJh8:KSZ607sQM/+IU6UN6UFC0AIAcHiiAJd1
TLSH
T16272E76D26AF5DCBD8A121B410810396FBE4E089E762519EFA5BCD671C41EBE8B600F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5blz5m4h.vnm.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5blz5m4h.vnm.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\LICENSE
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE-Intip.txt

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\LICENSE-Intip.txt
Size 2KB
SHA256 78a5eb823d4097186ec14e00dd6a043a93c24777b2a69f3218386aa0f5ee8bd0
MD5 70a666f5a419af578040f364783bb2a3
SHA1 ceded6ecd855986d90ddc8fad77b84986ad67166
SHA512 2c9fddfa070d037cdcdf98fe62aa85dc7fff03de1bdecdbd579cfb9559504618d2628dd17db97092bb0580a4f67b8048a8ed9ac8caaaa0a662900d3cbc93045c
TLSH
T156518A9B3F8C135D8650C2F05756FA17DA4AC36A2B36B46D4A448F702FF391992BD1C4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\LICENSES.chromium.html
Size 5.4MB
SHA256 7dac8267ac6da8d959cfe88f5f055b18a397f10230380b5329125e167bf5639b
MD5 3f5d5669497c9d912e5f0412611f992c
SHA1 4294658fd6a5be492b8745b6cbfca923f7344b2d
SHA512 e2c2084a34dec1b1009852dcba37912af48140e127029e84c73021d26b724d679b58f8fba2bd9319e20d026c52798401ccbfdb883088992df0724ec82dd7b22b
SSDEEP 49152:jCrmWndoHTYp22kuCenUBFIdACi4WMEAUYw6cif:+
TLSH
T10446C66B7E49037306F282616A47A5CAF31FA03E3B5A1654309CD1182B7BD2583FF69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

THIRD-PARTY-NOTICES.txt

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\THIRD-PARTY-NOTICES.txt
Size 7KB
SHA256 783d2a4d448ac67a817385abfe8d9e5c19b06aa4335f87faa3d3616d48f29b23
MD5 f2e7cf0132a0f0628857a6671d998163
SHA1 6e04baeffbe414d1ccf81f5cc6064d019fc20a0f
SHA512 e963318e1a884942cbe76c2f4a97d0212c4a86e92f3e582740b850a7bc23d3d6460fa04cb514c22589aeca097128106e8d9df3e88eb73d822932036c5cb1c3ff
SSDEEP 96:Q3MGmHPyFRH5o5tvsLQQHFot4nPUibMxxUDfGkKnjfRU88f+BktjVKvR1wyQeQHB:KLRH5SlQHF0fsMPZW88f+XvR9QHtn
TLSH
T1B7F1D82F7F4803B209C1D651E776A8DAF22B612D77AB65C8106ED1582376B2C42FF590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\chrome_100_percent.pak
Size 555KB
SHA256 8e865e7cd40faabcbfb4cd2be16ee290023c3a28796c4f95451440d80174225d
MD5 c97bf45b11f1ebcdcaa611c0340506ae
SHA1 dd6854739fa3a81a9b3edba865857949e429ce37
SHA512 efc241f950f8774237eab2e1e4c99fcc6f21edba2a705075ecbeffd6080a24f950049d9817e89b1b8abe0c0fd1d1d36945fbc5a863f48f30250089180b8d2059
SSDEEP 12288:U0/HeilX3lm3I3Hwzgsz5B0GDJQrnKs8SNP+QSsfSYJblIt6YJqrC:hmg3lmY3wzEEmPLdbc6iV
TLSH
T1C1C402E77374AC7DEF57463B826601B0FC735A680A92060A17DAF8B96907748D8D93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\chrome_200_percent.pak
Size 906KB
SHA256 352baed89a9051dc959dfa8e73024212ef98e173e37d0fc064887013748fcdca
MD5 c8d853423c9be7009db9162fa6380ce5
SHA1 4e2d7301e0ec12b582433d1390873f76993b64c0
SHA512 c3ae47f5354348ebf59a77148a8e8e4788ecd7a000ba8b2c23f2a5b9d4d44c18f5e8059610d42e7a88ddd45b2e919475da47ba00462c3ab09e00a672dba9f716
SSDEEP 24576:A9P2zzmecRvQt83cmmibkFR8+mZrIQwuSXAkpbaHz4:C2+P1QG3cmNbkFRJmJ8uSXAkh
TLSH
T14C1512D3D3B4ED3EDE520A37935B20E0FD7510271975191E0B26AD3A2D13788E9DAA83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 f5c95e919b4ffa1ac71049cd45b9f986d2965e6888395ca2806337985334fa56
MD5 f7b785e9d2d7a4ebd6374a555063a100
SHA1 da162478b19b05fedc9d8027bd182f6beeecdeda
SHA512 a287e97b14d1f66783e35f295dc0f355a1da1215aa514d307a01d31b12dd29cc4e9f591281ed6b4f9d8fc90fe7d647ae7d2ef0ad2c989c9dae2123462006776d
SSDEEP 49152:7MaW1H1ZcPsk9HOJLjJP73tSjPM2gjg9aIhR46LUbOWHHJdsCIdkTYoHjnTVyNMx:0cPsguxj34bwmvD3emt3Dnkr
TLSH
T148269E56B7E850E9C1BBD138C687861BE7B1B80513305BDF02908769AF73BD16A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

electron_wer.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\electron_wer.dll
Size 415KB
SHA256 234b9aba3c2c5bb545dedb26783692ec90313a3e17a532ae7c514f8058adf117
MD5 2f239082cff4b1d0b5fc66b559a3bd7c
SHA1 6f643de2a752aa49a892757e66a4571cbf5932ba
SHA512 abbc55b35e94c33017e8dab1c8a503da3c5c72760e8767631cc156fad320d63ea704e9e8c46ac78691a6aad2c357473d796a49dc2ac688f3174c1420c97745e0
SSDEEP 6144:0jYlWCwLC9fw6oCh7eU5BkNICuvIHvK6vHuyqkC6hMascq:ufC99o6oCh7jnkNICuvIHvWyjC
TLSH
T1D4948E04F7D448F8E07BD0388A278642EF71789A0F61E6DF03A456692F37BE45A79721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\ffmpeg.dll
Size 3.0MB
SHA256 cdf2b70f0f0a97c9840af1466dd86a90e564c98f6892d783635cf9c3b303d613
MD5 d8d488ec2c3c99ecb9a1dd1b7e6133c3
SHA1 e991bcef296217721e38c25e5a7d417d6a49f5d8
SHA512 5f58559ca805c07a4041ff73cb369462bc1e694643ce3fc62b115711cf6b4aee97a927ed888ced67a25b72e8262ee757b69fe23adf693991ce1760cca91a23d3
SSDEEP 49152:fjAmYvxRVRNqC/2t7Z+3/6TiD7NyzuCPKgc5mar9Yhp1EY2SDqk3hpygdiJyy1Nt:8LRVut7Z+3/o2Whi3
TLSH
T13BE5AD03F2E651E9D019C43497AF9323B674780A8F1099EF17905A252F67FE86D3E728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\icudtl.dat
Size 10.3MB
SHA256 02a01b3188b6a41a756f7322fdb5e6b5ca6573b327b01dfc8ed662d571a6f769
MD5 f015e0b90795dc239eb4617053220303
SHA1 222ef5d2a2200c1746a36c733ced2992a21fbd55
SHA512 3e649f05c60c92f7ea417a45daf6bdc4af8e2f7b56119d4bfed00dbcb59bf400ce9dd55fc2a08e146e3d4b623593e39da82c1ad8e3f8e2ccec69acf1f4e3626c
SSDEEP 98304:SAcBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPp897:SAcBhORok2HiXUxO/RJk3IWhlYntjdw7
TLSH
T158B62903A2EB4EC2F9FB9FB098F552779567BD49AE32805951043F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\locales\en-US.pak
Size 578KB
SHA256 de43db43fe0072543ab225f6d762cce3656a1639bf9e25f371fe0e80d9eabba7
MD5 f37a7d8a47814398d5d09cd573b8483a
SHA1 7f7fe1844a4235809c2f7f82881dc88669c447af
SHA512 ef36c2df703f6712b4c099dee14d84f28cc5fc1a4d84459450c37b73e85e24d67d22b4b72728507cd3d44a812d1f8c3405436dded551ce42e32f019a65b5820e
SSDEEP 6144:qZKyPAbrkCPapbQRJZmJHBH39VHf1KOHhNv3Ti+UUMP9IhI/efaY+73RJnYaFjNr:Omr4FgaJ7Hf1FNjMahI/J9FjNEwT
TLSH
T1FEC43C1FF744122A05A35262BF0995B2FF32906CB36112563CBD812C3376B66D2B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\locales\id.pak
Size 627KB
SHA256 7111a5623ece2362e16be5a785030a9a628937ab680db34c9dbab6ae7926d0e6
MD5 0ead9d304614957e5f03e20dd90fa392
SHA1 a887aab902cf158603d81354f357c562e6f12aee
SHA512 a7e182324648190d8855ea56e1b269d16fbaa09f116ab8550be164845dcde4c964935f25b98488e2081c0027e978a5e83d31ce212b981191ac8acfd4b5f02be4
SSDEEP 12288:TIxLd9ioCM/7uBzCaTFjlFemjKR6OJxvM:0leACB+aTFjlFRKR6OJxvM
TLSH
T163D4D7632ECD310C194542D9F2CDAA1E3CCE233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\resources.pak
Size 12.8MB
SHA256 a7b40d37892f0bb380b6735bdd9382ee69e9ca24dad1119bde5b53d55edb9b2b
MD5 130cec2ec715c55ecf3b49872c7f6a08
SHA1 55de2c50d44ba97ca9f57ed813e5cde8f9a3e286
SHA512 09eab97adc5b5f3c3a7ea624157f2e39c0410cc3d624cf487f17c779ccd54b483c787ef6540a7b23fb1cc5cdd62b1b82ba57af3187b9b6c1e10faa6b8311558c
SSDEEP 196608:9qRR3ZeqsPzZOgYimq8oR/5e7sba9AQ1cKqi3W1uVmVRtu+XK7KK7j9ZVRG:9qLZelLgg9mno8sb0AZKjCXu+ODVRG
TLSH
T1BAD6338462B86A3DDF91A379C2A80232DD4D8C2F09D591A20E5E316DAE334DD6FDD07D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\resources\app.asar
Size 2.9MB
SHA256 aba41758c3759a12f34e051d6ca790d0cae2a460df29f6bf98f12b929b4b812f
MD5 6dd6f25b0096119ae9b7f35b2b3574ea
SHA1 ae805fd2fa021e35de846fe9c5b1bcce2a4b2cb4
SHA512 81c231f27006d58304e668b64dd298e34a2f42389a718676c59de49edef2430b7177076847f5b0fdadf8e8e80899f8ad25293aa3f90af473a8e09a20b59f607d
SSDEEP 49152:yjQRQWG+L8O0lgG42XkHo8mhRk/QN9D3N4r7N11NZmJw1vF62E17SeHkG2PO3NWp:M+LsO
TLSH
T1CEE56E155EF250230673E2A99BCB5002F62D80233B58DE54FE9C63146F864BDB1BEBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

intip-helper.exe

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\resources\app.asar.unpacked\helper\intip-helper.exe
Size 28KB
SHA256 e43c3bef2f285294696bf0c61d88d02960dd366591a7225225f6073d14defc38
MD5 f0601e4962810a77b9f67052c783d26c
SHA1 75238d1c9af867bee3c31863998e3a82a35f7ea2
SHA512 cc6c83760ddb5dfc8358823bdc7bc5f1be32ea3de79237ee50e3e2a3c24ec5189e6e92b47ff40c3987677daa1514a28587c0a9bd82714aa81877f54bcb408612
SSDEEP 768:Svv5sukGvn1jqXuOYOf/WJWDgaSiM1jP:SnUGv0+Off+4bSdjP
TLSH
T1A1D26D09B3C48A25CA6F6F7CACF307500575FD8B5143E70E1CE899AE5E637C14A42AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\resources\app.asar.unpacked\node_modules\@koromix\koffi-win32-x64\win32_x64\koffi.node
Size 1.0MB
SHA256 f7af4982457657d2e7ad46acb076614ed7122d6efbdbfbc75f21ec12681fa121
MD5 7c7808712454bce050eb27e6144c298b
SHA1 c31ae42b5e0687de47ae51217d82c77623c221a5
SHA512 d246abbd42e16c1afdf458b6b6f64fd50322794ff524a8adfbb6eefc2a8e3357afa2f71b6b99d1a880109ec136224b1ea5ac36b81c93bb89039cb4862d75753a
SSDEEP 12288:NHWIS0qv1/QlSkMGSomP70K8LsQEEhzxvIGfM2Jb1md+dKXt/PO:NHK0qt/gDjE03LsQEEt42JLYXt
TLSH
T1DF25C342F70642D4C56EC4784B7BE3157521F84B077CA98BE6ACFEA83D126BC16392E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\snapshot_blob.bin
Size 365KB
SHA256 008725a9d014f3942dd22b0b7ddbf01347576a1f92217b4de03bcac178a83427
MD5 4ed64f22391a6010e9dc3e0875285b28
SHA1 684c57b3c1e4fac184b7ab96493a1e9ff743a58f
SHA512 f75a1111bdeb0f4e78a0f34f8ff3874a176dc8f546de2e4bfcca1455ede348b4be131b28438fe654a6b9d4e314d95c91b7ec65428354b994416e8fa827032717
SSDEEP 6144:Nt+HkTyTBiITxWRlTXKQu7eW24xqS2/Ny7I/WUX4cp:FyTET
TLSH
T1C184FF02B14ACB25CCD252344EFDCED43AB4B58DDE4E921B728087BDB4B95758EC268D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\v8_context_snapshot.bin
Size 735KB
SHA256 2fc28f6396a571fb6490504aff0b0f767bce24105cad2489dcc3d53396df8a38
MD5 a24118d8f7aab3307ac94af455df57b2
SHA1 f32e0853eef242c85152dd86fc7aee7ec044ad3a
SHA512 63c81c22011ef80b3653a05dbeba329d33d1c39005b6ddd0777156fc23d67b678cdf1618e13dd604dfad07ef45f45c52ac073c1491f8446329789942fbece60f
SSDEEP 6144:Pt+Hk+Igxuk40TxWRlTXKQu7eW24xqS2/Ny7I/WUXS2W7tfdlozz+87P5ih88lda:qUk4S2W71dezz+87PUtqw3oX
TLSH
T17FF4A772F50B8F29C9D653790DDA8E8E3A74F08DDE0A9007B20C937D74FD5A88E66119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\version
Size 6B
SHA256 281bb838d2512560c34bab2ceb5106a62f0fb0fe05f076896952a6153d007d94
MD5 3dbc39b3b84259c3b12a3ab83c3c4736
SHA1 8836f7787acca1a3ae2395e580cf3c50893ad96f
SHA512 aa43e5c478c7d265717c2758a0120254850ccb6395c8cd33230d7aeef9577e87bc76ef3467bb49a224eb8a1ce3f2a0e5eeba8c61abb1841a83435778beae59fc
MD5 SHA1 SHA512

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\vk_swiftshader.dll
Size 5.2MB
SHA256 00d703c0557b54edf35c284b15cb0063de1653edef71d33c698a64d2e74073c9
MD5 98642220caa57916f52465ed7e94cd24
SHA1 adc9c96a2c4106731f4478d9ca8563e6069dc444
SHA512 0ea31c78a854ea204cf4aeddea46551f74c8f123bbf991dd67682f613e8d6806d2cbbf0f9e87799a479c3ebd40348935af26e841790e441f33ee255014b9fc8d
SSDEEP 49152:DmSJKWEgDtaN8gXCoqqW0QtP6pe5RRKc96dXi1TifpAVvH+hMp8e7pMAqqAzHj5Y:DnKWEcHdUIG5wFFLv2
TLSH
T18F464903F28581E9D06DD579875BA623F672F8840B22B7CF56A00F192E66FE0A73D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\7z-out\vulkan-1.dll
Size 935KB
SHA256 0802c28ebf8226fccaef45fc44b528873eb4814f714a817b01cc2f6ab49c24da
MD5 cf41ff11a8a13770f1e4b332a76f01ee
SHA1 d288d5b650ecc5c44d2f046e69c69c01eebcdaf2
SHA512 e35c7574d532efc369ddb99a417e8d1432c83110058657ccb4204f88bf3e97002269e753643bfc2fb62a62ad9dc0c3ac75aaf197e18e1eb6bddad717a24b6484
SSDEEP 24576:PgWZPASFfqoy6Cko/hHMDTCyXbKNlC1E+Dkw7+Dv6g3v0TAE7yoeHbP:PgUPFyoyf/hHM/CyrKNlC1E+Dkw7+Dv9
TLSH
T162157D53D5948AB9DA7B8078CCD5490389F174A11722B6CF02B807142F5BFF46BBDB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2060.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Intip\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 70cad9a49744f75093e451573a6cd3073d216f562e74b590944b2b4debde524d
MD5 a2d72a752ef0af45d93ff0bcfc8f3b60
SHA1 00c6b2fb704adb949d6c5a788c8d54e99145edef
SHA512 bd748985261081376015181121ece263642d1d47c2afc2fd8908c2859e0f80df1723106bdfdde96c07494ba40c370b5de2e6203db599e942e58bf7dbee378c8d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Intip\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Intip\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Intip\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Intip\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Intip\Local State
Size 490B
SHA256 b98f1a34ab5aac9bb682a5de4c904d345ff92df9790d561949d3afd81bf3bc30
MD5 11e2f95d7ecebefdd8ea35f35becc2eb
SHA1 28f4866bca358658b6d265773c882c4a2acb6a55
SHA512 bfb0afc0527d4f5cc51323220fbf8699890f36da2e9ab88987e40c3fa367ac4f18c4e3d430592c9698b29d4a45cd2a04ebd008f23fb21f4f63bb15ed8a7d9bbc
TLSH
T15DF054762CF91D552A35078C0A07A1450E342FB70445AE00F6E000FB82FE8DF8A13D32
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Intip\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Intip\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State95ae3d99-11db-4fbb-908f-aa013c804d4d.tmp

Path C:\Users\Admin\AppData\Roaming\Intip\Network\Network Persistent State95ae3d99-11db-4fbb-908f-aa013c804d4d.tmp
Size 467B
SHA256 596ad5df8b15f8f078f832d620c30a64a2727e40127ae02efbea3320b659f6c6
MD5 599b3061b0421b093e0f3064c71afdf8
SHA1 f91c1a8dfc70d2d63655ad23cd7b96a8373db010
SHA512 d6ef26abf04d644df1008d569f23536be0f313e9d97b525be99186b3714ce7339a8595c3f031239b5746ca39d5f6f3fb816a1db56ce6c2a3a86384b9bc1fbcb7
TLSH
T108F05C93C6E816FF45A603F01A347927C27E084C42A87D05DEE8EB6E97E143A151148E
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Intip\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Intip.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intip.lnk
Size 2KB
SHA256 71364ad595b3566717e19d030909cce938ae2e755f45c78c6b8c6c47e7f0a55e
MD5 0d1653d075aba70d52043735e2b05bef
SHA1 b1ca0d081a237db7fe726426399aed26c5f507ac
SHA512 4fe435e330fc4f173fffd03826637213582666841bcfcd740de2de3ea224a96d1f972c1ab7b93775fd88a7a5d7e4735aa6949d118c208f70ede9534ad7f484f7
TLSH
T19441F0027ED91368E3FB463548F67B2B85BAFC55BB514B0D4061C2481D3AE01A92CF6E
MD5 SHA1 SHA512 TLSH

Submit Download

image.ico

Path C:\Windows\SystemTemp\scoped_dir4904_1737149886\image.ico
Size 101KB
SHA256 2852134e506e277848fcb2964845d1533a149f57b09243443ea19fe2306fb921
MD5 4f2986a3ea969c6fe88cdc711471c739
SHA1 cfc9e89a4561e233a5bd8d1c2c6bf68f3a43d81c
SHA512 5e84eaaa42527334b9ccf12dbbe8ec9c4fbda282f8ddf176ee118f442d08032f3b6d3c7f9995b59d5a7e28eaddba2b68e34ac70a5b166fa787316c33226633fe
SSDEEP 3072:7odnpnuc6d7zDai7CE26EceDdvv1ji3ucNI5:MdnpuPd7faiuEvj0dvU3u4I5
TLSH
T1B6A302F303B24D74CF6AC0740607E9B6683ADB27F8A7F6B53F99053C5AD97689001A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/672-391-0x000001B3A8070000-0x000001B3A808E000-memory.dmp

Download

memory/672-413-0x000001B3A9910000-0x000001B3A9E38000-memory.dmp

Download

memory/672-387-0x000001B3A7CA0000-0x000001B3A7CC2000-memory.dmp

Download

memory/672-392-0x000001B3A8090000-0x000001B3A8142000-memory.dmp

Download

memory/672-394-0x000001B3A82C0000-0x000001B3A82DA000-memory.dmp

Download

memory/672-393-0x000001B3A84B0000-0x000001B3A86B4000-memory.dmp

Download

memory/672-395-0x000001B3A8360000-0x000001B3A838A000-memory.dmp

Download

memory/672-397-0x000001B3A8080000-0x000001B3A8086000-memory.dmp

Download

memory/672-396-0x000001B3A8070000-0x000001B3A8078000-memory.dmp

Download

memory/672-398-0x000001B3A82B0000-0x000001B3A82B8000-memory.dmp

Download

memory/672-399-0x000001B3A8310000-0x000001B3A8336000-memory.dmp

Download

memory/672-402-0x000001B3A8AC0000-0x000001B3A8ACA000-memory.dmp

Download

memory/672-403-0x000001B3A8BF0000-0x000001B3A8C0E000-memory.dmp

Download

memory/672-404-0x000001B3A8BD0000-0x000001B3A8BDA000-memory.dmp

Download

memory/672-412-0x000001B3A8E30000-0x000001B3A8FF2000-memory.dmp

Download

memory/1312-434-0x0000025F61260000-0x0000025F61261000-memory.dmp

Download

memory/1312-436-0x0000025F61260000-0x0000025F61261000-memory.dmp

Download

memory/1312-444-0x0000025F61260000-0x0000025F61261000-memory.dmp

Download

memory/1312-443-0x0000025F61260000-0x0000025F61261000-memory.dmp

Download

memory/1312-442-0x0000025F61260000-0x0000025F61261000-memory.dmp

Download

memory/1312-441-0x0000025F61260000-0x0000025F61261000-memory.dmp

Download

memory/1312-440-0x0000025F61260000-0x0000025F61261000-memory.dmp

Download

memory/1312-445-0x0000025F61260000-0x0000025F61261000-memory.dmp

Download

memory/2076-75-0x000000006FD80000-0x000000006FDCC000-memory.dmp

Download

memory/2076-78-0x000000006FEE0000-0x000000007023B000-memory.dmp

Download

memory/2756-55-0x00000000733C0000-0x0000000073B7C000-memory.dmp

Download

memory/2756-57-0x00000000733C0000-0x0000000073B7C000-memory.dmp

Download

memory/2756-60-0x0000000005E50000-0x00000000061AB000-memory.dmp

Download

memory/2756-62-0x000000006FD80000-0x000000006FDCC000-memory.dmp

Download

memory/2756-65-0x00000000079E0000-0x0000000007A76000-memory.dmp

Download

memory/2756-66-0x0000000007960000-0x0000000007971000-memory.dmp

Download

memory/2756-68-0x00000000733C0000-0x0000000073B7C000-memory.dmp

Download

memory/2756-56-0x00000000733C0000-0x0000000073B7C000-memory.dmp

Download

memory/2852-378-0x00000000023F0000-0x00000000023FA000-memory.dmp

Download

memory/2852-377-0x00000000023E0000-0x00000000023E8000-memory.dmp

Download

memory/2852-376-0x0000000000180000-0x000000000018E000-memory.dmp

Download

memory/5216-269-0x00007FFD3B160000-0x00007FFD3B161000-memory.dmp

Download

memory/5216-423-0x000001F45C140000-0x000001F45C1F2000-memory.dmp

Download

memory/5216-411-0x000001F45C140000-0x000001F45C1F2000-memory.dmp

Download

memory/5216-270-0x00007FFD39110000-0x00007FFD39111000-memory.dmp

Download

memory/5928-39-0x00000000733C0000-0x0000000073B7C000-memory.dmp

Download

memory/5928-27-0x0000000005740000-0x0000000005762000-memory.dmp

Download

memory/5928-29-0x0000000005FD0000-0x0000000006036000-memory.dmp

Download

memory/5928-33-0x00000000064F0000-0x000000000650E000-memory.dmp

Download

memory/5928-34-0x0000000006540000-0x000000000658C000-memory.dmp

Download

memory/5928-35-0x00000000074C0000-0x00000000074F6000-memory.dmp

Download

memory/5928-40-0x0000000007500000-0x0000000007520000-memory.dmp

Download

memory/5928-36-0x000000006FD80000-0x000000006FDCC000-memory.dmp

Download

memory/5928-28-0x0000000005F60000-0x0000000005FC6000-memory.dmp

Download

memory/5928-26-0x00000000733C0000-0x0000000073B7C000-memory.dmp

Download

memory/5928-41-0x00000000077C0000-0x0000000007863000-memory.dmp

Download

memory/5928-42-0x00000000733C0000-0x0000000073B7C000-memory.dmp

Download

memory/5928-24-0x00000000733C0000-0x0000000073B7C000-memory.dmp

Download

memory/5928-32-0x0000000006040000-0x000000000639B000-memory.dmp

Download

memory/5928-44-0x0000000007870000-0x000000000788A000-memory.dmp

Download

memory/5928-45-0x00000000733C0000-0x0000000073B7C000-memory.dmp

Download

memory/5928-43-0x0000000007EF0000-0x000000000856C000-memory.dmp

Download

memory/5928-46-0x00000000078E0000-0x00000000078EA000-memory.dmp

Download

memory/5928-48-0x0000000007AB0000-0x0000000007AD4000-memory.dmp

Download

memory/5928-47-0x0000000007A80000-0x0000000007AAA000-memory.dmp

Download

memory/5928-49-0x000000006FEE0000-0x000000007023B000-memory.dmp

Download

memory/5928-51-0x00000000733C0000-0x0000000073B7C000-memory.dmp

Download

memory/5928-25-0x0000000005820000-0x0000000005E6A000-memory.dmp

Download

memory/5928-23-0x0000000003000000-0x0000000003036000-memory.dmp

Download

memory/5928-22-0x00000000733D2000-0x00000000733D3000-memory.dmp

Download