plugx | hxxps://summer-surf-9998[.]on[.]fleek[.]co/#dana@innovator[.]lv

Analysis

max time kernel
4294390s
max time network
329s
platform
windows7_x64
resource
win7-20220310-en
submitted
30-03-2022 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://summer-surf-9998.on.fleek.co/#[email protected]

Score

10^/10

plugx spyware stealer trojan

Malware Config

Signatures

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

PlugX Rat Payload 7 IoCs

resource	yara_rule
behavioral1/files/0x000400000001d6c4-67.dat	PlugX
behavioral1/files/0x000400000001d6c4-69.dat	PlugX
behavioral1/files/0x000400000001d6c4-71.dat	PlugX
behavioral1/files/0x000400000001d6c4-93.dat	PlugX
behavioral1/files/0x000400000001d74b-100.dat	PlugX
behavioral1/files/0x000400000001d74b-107.dat	PlugX
behavioral1/files/0x000400000001d6c4-128.dat	PlugX

Executes dropped EXE 4 IoCs

pid	Process
2112	software_reporter_tool.exe
2360	software_reporter_tool.exe
2816	software_reporter_tool.exe
2968	software_reporter_tool.exe

Loads dropped DLL 8 IoCs

pid	Process
608	chrome.exe
2816	software_reporter_tool.exe
2816	software_reporter_tool.exe
2816	software_reporter_tool.exe
2816	software_reporter_tool.exe
2816	software_reporter_tool.exe
2816	software_reporter_tool.exe
2816	software_reporter_tool.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5609A51-B02E-11EC-9BD0-6E9EAED24999} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ba41923b44d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e500000000020000000000106600000001000020000000052f1afc3b45aa7514c09e33ac47be5bffc3971cca504748cc1b7ffb10dbbc29000000000e80000000020000200000004a84331122a6bc07f537c70d27cff0c40ed71c171db6968d3deb19c1af4339ce20000000af7a67b18fffbebfc37c4eebd627932a5a72e8f9382e6360baf25560fa9053d44000000011f8752c7b18090fff348a22144204d157b73e99ba5c2752387a2d29f64d133377c9348e9b4786029a3ee1b529d0b97f7e9daa656d3e21a1ff822bdee300b21d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e5000000000200000000001066000000010000200000002fd80bd1a3d0a93e95f56716c93f3d5be0de36269db938fe2f8c070f4074d1c3000000000e80000000020000200000005c1a9f8b10e066e8ba3060976106ec237a18bb143fec3e071d484f3b5ed692cd90000000a8e5a614e7dda044aacee96dc8236b8de8f79ea3fd13afb4a9c53bea634cbe20d9cee209d96516f272d9bd335a7159e403f72548461f8fb3793e20f49817a6ab74102306947481a800f0959fef1473d57949d10016212f1692a4d62a756e24b1ebd55c00cc97183a7cd6e9e531068d7af3104b946abb6d47727d2a19dc3be345dfda061d7c25a8bdbf2892b8b34ce48840000000fce7bf939c147b80809c17cef1b9ee73d957e3ce3931d20c05dc34b2a8ae1ff23edac6986aebfc8c31b5609b9a133df61c94c89878f44e7eb03bd5c1c5d6c828	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Zoom\ZoomFactor = "100000"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000000700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009acbbc286be63c4682a409f320de94d7	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "355412498"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1212	chrome.exe
608	chrome.exe
608	chrome.exe
2772	chrome.exe
2400	chrome.exe
2588	chrome.exe
2112	software_reporter_tool.exe
2112	software_reporter_tool.exe
608	chrome.exe
608	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	iexplore.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	2360	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2360	software_reporter_tool.exe
Token: 33	2112	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2112	software_reporter_tool.exe
Token: 33	2816	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2816	software_reporter_tool.exe
Token: 33	2968	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2968	software_reporter_tool.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1632	iexplore.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe
608	chrome.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1632	iexplore.exe
1632	iexplore.exe
556	IEXPLORE.EXE
556	IEXPLORE.EXE
556	IEXPLORE.EXE
556	IEXPLORE.EXE
1632	iexplore.exe
556	IEXPLORE.EXE
556	IEXPLORE.EXE
1716	iexplore.exe
1716	iexplore.exe
556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 556	1632	iexplore.exe	28
PID 1632 wrote to memory of 556	1632	iexplore.exe	28
PID 1632 wrote to memory of 556	1632	iexplore.exe	28
PID 1632 wrote to memory of 556	1632	iexplore.exe	28
PID 1632 wrote to memory of 1716	1632	iexplore.exe	32
PID 1632 wrote to memory of 1716	1632	iexplore.exe	32
PID 1632 wrote to memory of 1716	1632	iexplore.exe	32
PID 608 wrote to memory of 1808	608	chrome.exe	34
PID 608 wrote to memory of 1808	608	chrome.exe	34
PID 608 wrote to memory of 1808	608	chrome.exe	34
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 644	608	chrome.exe	35
PID 608 wrote to memory of 1212	608	chrome.exe	36
PID 608 wrote to memory of 1212	608	chrome.exe	36
PID 608 wrote to memory of 1212	608	chrome.exe	36
PID 608 wrote to memory of 900	608	chrome.exe	37
PID 608 wrote to memory of 900	608	chrome.exe	37
PID 608 wrote to memory of 900	608	chrome.exe	37
PID 608 wrote to memory of 900	608	chrome.exe	37
PID 608 wrote to memory of 900	608	chrome.exe	37
PID 608 wrote to memory of 900	608	chrome.exe	37
PID 608 wrote to memory of 900	608	chrome.exe	37
PID 608 wrote to memory of 900	608	chrome.exe	37
PID 608 wrote to memory of 900	608	chrome.exe	37
PID 608 wrote to memory of 900	608	chrome.exe	37

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://summer-surf-9998.on.fleek.co/#[email protected]
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:556
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1632 CREDAT:275488 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6de4f50,0x7fef6de4f60,0x7fef6de4f70
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1132 /prefetch:2
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1672 /prefetch:8
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2952 /prefetch:2
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3928 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4176 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=544 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:2468
- C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=TXT3Wo1VSaO4Kl/iuJamCtmEagaYQndkIZcu33Ib --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2112
- - \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe
    "c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=99.279.200 --initial-client-data=0x160,0x164,0x168,0x134,0x16c,0x13fb825a0,0x13fb825b0,0x13fb825c0
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- - \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe
    "c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_2112_RQRSECPFSRZIGNZE" --sandboxed-process-id=2 --init-done-notifier=476 --sandbox-mojo-pipe-token=4690321804362719454 --mojo-platform-channel-handle=452 --engine=2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
- - \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe
    "c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_2112_RQRSECPFSRZIGNZE" --sandboxed-process-id=3 --init-done-notifier=640 --sandbox-mojo-pipe-token=2150271389443694044 --mojo-platform-channel-handle=636
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1860 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1124,12683781170269105320,13922663805589984699,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
69511a066a295d458a89e2b926a249f7

SHA1
83d582f87fa55d528af6d783763bb2502b377bdc

SHA256
855e73ab029929bcaeaead593218c4b481fa40bb108f07aa3634af903bbbcf06

SHA512
9c44dd911dc73fa456cde99fbaef62486c9f5c2c0ee3a2250813b60a7398ca60dad824c625e3af7553069880f2bcbaef91602acd6cb423509243248a0e4a2a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
569f21f6a80ecc326d98befa0d79e633

SHA1
e8be434784f960d810c794977588c079bb2c34e0

SHA256
c78855b7212e08fc6a9cbdf8cf5fddf95c3d9ec7deb53fa8467b0d981b6a5e01

SHA512
3c4addf6d8b41512bdbc9a686ccbfa1f9223af55e6fbe746052eab7ab356bdcdb25f235bcfbbe709177ad58aaff77881224a6ceed86a073d2fc014ec2cd2c78c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_86C2A03C133240EC4C95180B9FD368BB

Filesize
471B

MD5
a74af5d684a4f8e897a3d14ec609ba21

SHA1
cc2405f1d5eeade1050423781fae33c3dd1fc880

SHA256
befeed8f329f2c6aa1492a5469b045275d091e052cbc1c4c0c5ff844dcaf539e

SHA512
db090cae8b0d7c7acc87f8228f40ed7b6abe5cc5fc5a7dda8cf695d59cfafb51853be5f8a741fe83d32067ea341e69775dd2d8c3190073be9135994b53fdbb4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_DEA9E6EF835944EE4D67BEC1CABD1368

Filesize
471B

MD5
ad21d8a22bfc48de795d91501cc5a3e5

SHA1
c9f83b9049adc928eb87ce943ae7d24c271d247a

SHA256
301b1db4ad2040b0ef03b4edf7308057d12c355594d842ad81fa6a3b5dd0c15d

SHA512
4b45b6203e51aab9913fe685b6b95b18060aa7a66098db707332f34406de3cf60fcbc316ba96c1a893fe37e2a24ad20b4ac46d726a394f29862fa319efc1621f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
64e9b8bb98e2303717538ce259bec57d

SHA1
2b07bf8e0d831da42760c54feff484635009c172

SHA256
76bd459ec8e467efc3e3fb94cb21b9c77a2aa73c9d4c0f3faf823677be756331

SHA512
8980af4a87a009f1ae165182d1edd4ccbd12b40a5890de5dbaea4dbf3aeb86edffd58b088b1e35e12d6b1197cc0db658a9392283583b3cb24a516ebc1f736c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
ac57d31c86165eeebc37bd6c5b15c873

SHA1
0ee858171ed90f8014f85ca597cb62ea5a5b6059

SHA256
6d4e4b3ca55e3035dd7aef183fbf7ad8711af7809314320ec69c3ff84cb45265

SHA512
3ec13b961082c9fb18b5b912ba53ae4b74ab00f93ea81d3513a64a11a05bc0bfd4ac464a92d14734dd28ff843d3c40364c9c17dda378e4997ddbacd4d6df5924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
438B

MD5
c145e2d9c8ad6966c3d780f0ca8ce8aa

SHA1
779d40311ce6150a9c4fc8a7b0c64ef2624d4a2d

SHA256
eb117dfd05fadc1e05070f47ce2da442e9734be708449d0b88a4e1eb4f7b3d38

SHA512
69a3267109cf5b2f3650a0e96d4c81a23f7aea09edfa9f144410bd68f3c88e0bd98201a31c20b55b6baa297902ce5293d875f4505941317bb59aa17d03cbd2af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_86C2A03C133240EC4C95180B9FD368BB

Filesize
430B

MD5
906690fca21781d73968ce02aacb3dc8

SHA1
db8caa9c9fba5cd666433cce0d4d38d4abe652cf

SHA256
8b8a5fa46caeb3cab26e0ce44cb27295a02ab692f928b030d1ad339c25700ffd

SHA512
1d002d93411a9d3a93c67d267c34711aecb32a633a3a34d516ae42219922e525560af33e70439d791bc919f34aff194a378e7d399c545487c5d218c192a230aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f47ffd99672cf05f7bfa751092253e1

SHA1
63e6668ed7747d163c1106ccc17d37f6a02eca70

SHA256
1127055988832d283742d4526f4f217598106cb64a0fab95d7c625a21b86b9ce

SHA512
6ea578244dde5f92e83b6bb1ff416e1851d8ee5b05e32ff31151aa3e6f26b4705aaeb59708d889d338105918f9f61b3325a83719df5d530377adb8dbf4808488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_DEA9E6EF835944EE4D67BEC1CABD1368

Filesize
410B

MD5
3cdc5cefc2145991c1e567eb8e81c6ac

SHA1
d209bd39dd1168bdcab4c121ce2190f4221cbc36

SHA256
803cebe181bfff006c3f4f9d2b8718ad8ab15cb4f17fb55f7a4848d3c2aea851

SHA512
6da1951f9bdd65626b032b137b4f5162787a4f5228e40bde24ac0931e7408ef761d7aab85871c544e1928f30ce4c69b1559400e0d83a687eeaccc977256a61da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
755955d6db182f869fd3f9ef707270e5

SHA1
9f9642f8eac0cce6976cbb96eef6e5eb731e39bc

SHA256
fc9926a1e07770c2f92bf287c40ab00316550aa3e2f7b3c0f9ede2db58c1243d

SHA512
72a129871d1b893a8852a3b7855277514b9c73ef44371bc4fb39388ad18369d3bb70027e1405da6c1ea2743a5da7b78cea5f2fdc71d134a216c88d36f3338c7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe

Filesize
13.9MB

MD5
3dcd45838971b3e51d01e62c09d36e08

SHA1
9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a

SHA256
d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81

SHA512
6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe

Filesize
13.9MB

MD5
3dcd45838971b3e51d01e62c09d36e08

SHA1
9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a

SHA256
d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81

SHA512
6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe

Filesize
13.9MB

MD5
3dcd45838971b3e51d01e62c09d36e08

SHA1
9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a

SHA256
d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81

SHA512
6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe

Filesize
13.9MB

MD5
3dcd45838971b3e51d01e62c09d36e08

SHA1
9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a

SHA256
d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81

SHA512
6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log

Filesize
2KB

MD5
a55a42953b0d8c13093024d5bccc9db1

SHA1
0df735edc3a69ce631d080c0eee78636f69d83d3

SHA256
fbc8ebde0e8e1b101905bdd399803260da36ab39265d430310ff1f70831a4298

SHA512
ee850053fa71d572402f10b71b62f31f481376944f6a51134e14ef74363b87f10474170fac6ee524be3fc755f4a75fcf3e529f8e3bf7ff670008842c7226e9ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Z86W0OPN.txt

Filesize
607B

MD5
1b28863ad8a3de4ca3a54b90e86da71e

SHA1
aadd096d252b3a00bc723fe9378781cd202350d4

SHA256
fca86b3a2d3a37602e1fa76edc1d87ab4d0b350cceb1b7952d8609d12843c3a0

SHA512
57f0a098c9a9d79068b38be0a162541fcca1d1b60dd1d891861ea950fb409da478223bc937b28790cf0097113942b0cefef6344bcf74945d7909a52c4ed42b51

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat

Filesize
40B

MD5
b9e6864185e827e173dd1eea2357345a

SHA1
ea530de434ea2473b28b606f0c63fef5367351da

SHA256
e0e3d9f7bf176fc71d49b17aced0beccb60ff2cabf080cf019686df5a73f2033

SHA512
2b48b4a71a9a995fc5843bdbd636a1cd5b7d65c8f7c719e752ca295af4e6249cdb02675a9d87e523481e8ebe8ffcedeeb919cf583e2725def7bc78f9679be83c

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat

Filesize
40B

MD5
b9e6864185e827e173dd1eea2357345a

SHA1
ea530de434ea2473b28b606f0c63fef5367351da

SHA256
e0e3d9f7bf176fc71d49b17aced0beccb60ff2cabf080cf019686df5a73f2033

SHA512
2b48b4a71a9a995fc5843bdbd636a1cd5b7d65c8f7c719e752ca295af4e6249cdb02675a9d87e523481e8ebe8ffcedeeb919cf583e2725def7bc78f9679be83c

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat

Filesize
40B

MD5
b9e6864185e827e173dd1eea2357345a

SHA1
ea530de434ea2473b28b606f0c63fef5367351da

SHA256
e0e3d9f7bf176fc71d49b17aced0beccb60ff2cabf080cf019686df5a73f2033

SHA512
2b48b4a71a9a995fc5843bdbd636a1cd5b7d65c8f7c719e752ca295af4e6249cdb02675a9d87e523481e8ebe8ffcedeeb919cf583e2725def7bc78f9679be83c

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em000_64.dll

Filesize
36KB

MD5
d0cf72186dbaea05c5a5bf6594225fc3

SHA1
0e69efd78dc1124122dd8b752be92cb1cbc067a1

SHA256
225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

SHA512
8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em001_64.dll

Filesize
378KB

MD5
7adcb76ec34d774d1435b477e8625c47

SHA1
ec4ba0ad028c45489608c6822f3cabb683a07064

SHA256
a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d

SHA512
c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em002_64.dll

Filesize
2.2MB

MD5
5913dc18fc2a5dd49ba064655ac75c24

SHA1
d941ea7f6a7aa6c8b7dbc65fa37b6bf41dcd9069

SHA256
090b958bd2806e2571198847fad60ba446282b783d2da44efe3a879d0507701f

SHA512
d71edd1d2a5fa643f22fe0947c5910cf6b796845f6a782dd8503907babce49055175010296fbd890ff9ce0b3dd5df7ebfe7b8fb079c0ae4b7e562099d6e84197

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em003_64.dll

Filesize
1.3MB

MD5
ced50723c5ae960adfd3fc726b34cdb1

SHA1
962a477d168b786b3d1a301793ab91e1a850f376

SHA256
5a9dc132339862cc79f38c1b17db4c0fafa58eec396608ac1583784f1b3b6532

SHA512
ad70cac1f0a65362f4c2d1c221564c23fc2beecc9842aeb513a1448f2820d987e014af0557a30d50ae136d0bea83b8254ba871937576d3097fce567add578bee

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em004_64.dll

Filesize
6.1MB

MD5
6e1f355a54cf57047647beb9f5aca079

SHA1
529f42911634143507f28d4ea0b6757d6f17af65

SHA256
10a6c06788b110c0bfd26603d1dc4e3aec48ba917d4d80dac9fb34f83808eee6

SHA512
5ca0bbd9d2337c2e0019969725e904c1ab829dde36d4b35235cc6175d86996dabd2542914d7be0378ed298b758c9e542e059107db8ab7e3de424ac48b8d3aa74

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em005_64.dll

Filesize
576KB

MD5
169a2ef320119891cf3189aa3fd23b0e

SHA1
de51c936101ef79bbc0f1d3c800cf832d221eef8

SHA256
1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780

SHA512
7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\edls_64.dll

Filesize
446KB

MD5
e9a7c44d7bda10b5b7a132d46fcdaf35

SHA1
5217179f094c45ba660777cfa25c7eb00b5c8202

SHA256
35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1

SHA512
e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em000_64.dll

Filesize
36KB

MD5
d0cf72186dbaea05c5a5bf6594225fc3

SHA1
0e69efd78dc1124122dd8b752be92cb1cbc067a1

SHA256
225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

SHA512
8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em001_64.dll

Filesize
378KB

MD5
7adcb76ec34d774d1435b477e8625c47

SHA1
ec4ba0ad028c45489608c6822f3cabb683a07064

SHA256
a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d

SHA512
c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em002_64.dll

Filesize
2.2MB

MD5
5913dc18fc2a5dd49ba064655ac75c24

SHA1
d941ea7f6a7aa6c8b7dbc65fa37b6bf41dcd9069

SHA256
090b958bd2806e2571198847fad60ba446282b783d2da44efe3a879d0507701f

SHA512
d71edd1d2a5fa643f22fe0947c5910cf6b796845f6a782dd8503907babce49055175010296fbd890ff9ce0b3dd5df7ebfe7b8fb079c0ae4b7e562099d6e84197

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em003_64.dll

Filesize
1.3MB

MD5
ced50723c5ae960adfd3fc726b34cdb1

SHA1
962a477d168b786b3d1a301793ab91e1a850f376

SHA256
5a9dc132339862cc79f38c1b17db4c0fafa58eec396608ac1583784f1b3b6532

SHA512
ad70cac1f0a65362f4c2d1c221564c23fc2beecc9842aeb513a1448f2820d987e014af0557a30d50ae136d0bea83b8254ba871937576d3097fce567add578bee

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em004_64.dll

Filesize
6.1MB

MD5
6e1f355a54cf57047647beb9f5aca079

SHA1
529f42911634143507f28d4ea0b6757d6f17af65

SHA256
10a6c06788b110c0bfd26603d1dc4e3aec48ba917d4d80dac9fb34f83808eee6

SHA512
5ca0bbd9d2337c2e0019969725e904c1ab829dde36d4b35235cc6175d86996dabd2542914d7be0378ed298b758c9e542e059107db8ab7e3de424ac48b8d3aa74

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em005_64.dll

Filesize
576KB

MD5
169a2ef320119891cf3189aa3fd23b0e

SHA1
de51c936101ef79bbc0f1d3c800cf832d221eef8

SHA256
1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780

SHA512
7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe

Filesize
13.9MB

MD5
3dcd45838971b3e51d01e62c09d36e08

SHA1
9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a

SHA256
d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81

SHA512
6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa

Download Submit
memory/2816-91-0x000000013FB87000-0x000000013FB88000-memory.dmp

Filesize
4KB

Download
memory/2816-90-0x000000013FB87000-0x000000013FB88000-memory.dmp

Filesize
4KB

Download
memory/2968-126-0x000000013FB87000-0x000000013FB88000-memory.dmp

Filesize
4KB

Download
memory/2968-125-0x000000013FB87000-0x000000013FB88000-memory.dmp

Filesize
4KB

Download