hxxps://gofile[.]io/d/l55DLk

Analysis

max time kernel
332s
max time network
368s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/l55DLk

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\vulndrv3.sys	loader.exe
File opened for modification	C:\Windows\System32\drivers\vulnerabledrv.sys	loader.exe
File opened for modification	C:\Windows\System32\drivers\vulndrv3.sys	loader.exe
File opened for modification	C:\Windows\System32\drivers\vuldrv2.sys	loader.exe
File opened for modification	C:\Windows\System32\drivers\vulnerabledrv.sys	loader.exe
File created	C:\Windows\System32\drivers\vulnerabledrv.sys	loader.exe
File opened for modification	C:\Windows\System32\drivers\vuldrv2.sys	loader.exe
File opened for modification	C:\Windows\System32\drivers\vuldrv2.sys	loader.exe
File opened for modification	C:\Windows\System32\drivers\vulnerabledrv.sys	loader.exe
File created	C:\Windows\System32\drivers\vuldrv2.sys	loader.exe
File opened for modification	C:\Windows\System32\drivers\vulnerabledrv.sys	loader.exe
File opened for modification	C:\Windows\System32\drivers\vuldrv2.sys	loader.exe
File opened for modification	C:\Windows\System32\drivers\vulndrv3.sys	loader.exe
File created	C:\Windows\System32\drivers\vulndrv3.sys	loader.exe
File opened for modification	C:\Windows\System32\drivers\vulndrv3.sys	loader.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QnbbHVMAJunJHjC\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\QnbbHVMAJunJHjC"	mz.krn.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nONlKeUHopPZwTBPDOuFqraO\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\nONlKeUHopPZwTBPDOuFqraO"	mz.krn.exe

Executes dropped EXE 14 IoCs

pid	Process
628	loader.exe
3996	mz.krn.exe
4960	loader.exe
768	loader.exe
3504	loader.exe
1476	mz.krn.exe
336	loader.exe
628	loader.exe
3996	mz.krn.exe
4960	loader.exe
768	loader.exe
3504	loader.exe
1476	mz.krn.exe
336	loader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
98	raw.githubusercontent.com
99	raw.githubusercontent.com
133	raw.githubusercontent.com

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\System32\mz.krn.exe	loader.exe
File opened for modification	C:\Windows\System32\NetFixer.bat	loader.exe
File opened for modification	C:\Windows\System32\udsels.bat	loader.exe
File created	C:\Windows\System32\udsels.bat	loader.exe
File opened for modification	C:\Windows\System32\udsels.bat	loader.exe
File opened for modification	C:\Windows\System32\mz.krn.exe	loader.exe
File opened for modification	C:\Windows\System32\mz.krn.exe	loader.exe
File opened for modification	C:\Windows\System32\udsels.bat	loader.exe
File opened for modification	C:\Windows\System32\mz.krn.exe	loader.exe
File created	C:\Windows\System32\NetFixer.bat	loader.exe
File opened for modification	C:\Windows\System32\NetFixer.bat	loader.exe
File opened for modification	C:\Windows\System32\udsels.bat	loader.exe
File opened for modification	C:\Windows\System32\mz.krn.exe	loader.exe
File opened for modification	C:\Windows\System32\NetFixer.bat	loader.exe
File opened for modification	C:\Windows\System32\NetFixer.bat	loader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133561393616535302"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4912	chrome.exe
4912	chrome.exe
2172	chrome.exe
2172	chrome.exe
4912	chrome.exe
4912	chrome.exe
2172	chrome.exe
2172	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
3996	mz.krn.exe
1476	mz.krn.exe
3996	mz.krn.exe
1476	mz.krn.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe
Token: SeShutdownPrivilege	4912	chrome.exe
Token: SeCreatePagefilePrivilege	4912	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
2972	7zG.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe

Suspicious use of SendNotifyMessage 52 IoCs

pid	Process
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe
4912	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 3220	4912	chrome.exe	85
PID 4912 wrote to memory of 3220	4912	chrome.exe	85
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 4860	4912	chrome.exe	90
PID 4912 wrote to memory of 424	4912	chrome.exe	91
PID 4912 wrote to memory of 424	4912	chrome.exe	91
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92
PID 4912 wrote to memory of 4924	4912	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/l55DLk
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffc8b5f9758,0x7ffc8b5f9768,0x7ffc8b5f9778
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4628 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1616 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3252 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3496 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3500 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:1
  2⤵
  PID:3668

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3416

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap24023:76:7zEvent23224
1⤵
- Suspicious use of FindShellTrayWindow
PID:2972

C:\Users\Admin\Desktop\loader.exe
"C:\Users\Admin\Desktop\loader.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
PID:628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  PID:3524
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5
    3⤵
    PID:376
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1684
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color c
  2⤵
  PID:3712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\mz.krn.exe C:\Windows\System32\drivers\vuldrv2.sys
  2⤵
  PID:3112
- - C:\Windows\System32\mz.krn.exe
    C:\Windows\System32\mz.krn.exe C:\Windows\System32\drivers\vuldrv2.sys
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: LoadsDriver
    PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2756

C:\Users\Admin\Desktop\loader.exe
"C:\Users\Admin\Desktop\loader.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  PID:4448
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5
    3⤵
    PID:3804
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4616
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color c
  2⤵
  PID:2952

C:\Users\Admin\Desktop\loader.exe
"C:\Users\Admin\Desktop\loader.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  PID:2108
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5
    3⤵
    PID:2492
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4400
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color c
  2⤵
  PID:1112

C:\Users\Admin\Desktop\loader.exe
"C:\Users\Admin\Desktop\loader.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
PID:3504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  PID:632
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5
    3⤵
    PID:2900
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2480
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color c
  2⤵
  PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\mz.krn.exe C:\Windows\System32\drivers\vulnerabledrv.sys
  2⤵
  PID:4468
- - C:\Windows\System32\mz.krn.exe
    C:\Windows\System32\mz.krn.exe C:\Windows\System32\drivers\vulnerabledrv.sys
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: LoadsDriver
    PID:1476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4064

C:\Users\Admin\Desktop\loader.exe
"C:\Users\Admin\Desktop\loader.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
PID:336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  PID:3496
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5
    3⤵
    PID:2108
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3624
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color c
  2⤵
  PID:2324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start C:\Windows\System32\NetFixer.bat
  2⤵
  PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Windows\System32\NetFixer.bat
    3⤵
    PID:2524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
      4⤵
      PID:2452
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where physicaladapter=true get deviceid
        5⤵
        
        PID:2980
    - - C:\Windows\system32\findstr.exe
        
        findstr [0-9]
        5⤵
        
        PID:884
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01"
      4⤵
      PID:2132
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001"
      4⤵
      PID:5104
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001"
      4⤵
      PID:3100
  - - C:\Windows\system32\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001" /v NetworkAddress /t REG_SZ /d 02-2C9ACA2922A /f
      4⤵
      PID:3584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
      4⤵
      PID:4876
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where physicaladapter=true get deviceid
        5⤵
        
        PID:2724
    - - C:\Windows\system32\findstr.exe
        
        findstr [0-9]
        5⤵
        
        PID:3236
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01"
      4⤵
      PID:1508
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001"
      4⤵
      PID:632
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001"
      4⤵
      PID:4188
  - - C:\Windows\system32\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001" /v PnPCapabilities /t REG_DWORD /d 24 /f
      4⤵
      PID:5072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
      4⤵
      PID:1172
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
        5⤵
        
        PID:2148
  - - C:\Windows\system32\netsh.exe
      netsh interface set interface name="Ethernet" disable
      4⤵
      PID:228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause >nul
  2⤵
  PID:4264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
471B

MD5
8c3079c9837342ec5747ce3b1b5f5370

SHA1
72e5aced39046c780b09df80e17c3e2f691a53e1

SHA256
fdebe461d97b5b06a1dfc51564b7fd09d71606e347b38af8ebe9a0243a788cfa

SHA512
f04ea7a7b3e32d6fd8120b785fa31bd4178f488beb101ecfa9c934804224ab8cff89d3b95df5ca90038a8574a00bd3b89d61633af7bc35194c7b1b500c35f613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
412B

MD5
87cbddc44f213e32287cd3c179be2edb

SHA1
202cc8966dabed8f8996b584d612bd73c3a940b2

SHA256
6d3a11357014f3836696b70635e394caaf7b378d5d53a71e8efddae6c8407346

SHA512
0c0db1a70c833986a53a05a25c3bc0fd4bc7b112618545a63540ab9a94745fbfdc56af16a793f53ef83956fc3e1fe8f6a1026c5ecf11d3ad01e976bda7825009

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
53095d91dfe5e55ca8c31900a478f51a

SHA1
f2e26ace05663d7788859ef3d3a14a592d4cbd5e

SHA256
df732fd2e7680dfbaa6e03902d47ac21f8e257df655d8fd4ff20c54e7bbdda34

SHA512
6cd8793305a71afd26e05473bd6f4c201bf1d6814be8c4e886074caff45d965ab2e8a8ef504ab9e0655b64ca55000a15516ba953415eb92516a630f15587c861

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
6c08ca043d75bc4efd5d53a0aa0f736a

SHA1
8674f8ebbe85e135bd0e87da0598e4c11d539817

SHA256
82541ce684a9aab70273d74f4b04535b4d44f8ed0f9f3b4075947521a4a168e5

SHA512
cb24b7789848321c8a692e1d01a0adf6feffca623413d3c2f1f266e9447a60c7b287c01130ae39d1cb157bf3f0cf3c9bfd5eda4a38adfe9e6f6ed84082770ba1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b1ed31f4a010be453b67c6e200a32708

SHA1
a45a8957ffe4bd52b95a8f697851f8831be52ae8

SHA256
e2199550e39e073962fe43bffe6aae68ffbd1f26c6802a409443e501df585e8c

SHA512
cb729e42b7d7ed548110110925b3a99b8ea7c70edaf274b24ff75b995e4df057dedfec7a1ee5edad8b2b17f730cff7ed84562b5c316e547c74004e4f062804e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
6984ef0771a84cda834c6ef88613d506

SHA1
ca9fb490f961ab002464608cdbced78e9ab623fa

SHA256
2f3a1dc28654fb6f628b6a162d14a07bae9393480d41ad581e65d7353cab8138

SHA512
11270d4cbe668bcbc663ed492a61d9cae73bd3385e7d857cb832a9977b9a0be23734455b45f67d45ae938eb32878e7b94adf373d0a0b681308791abe2bed1b0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
5a90cc97a678560275bb21a6f4577917

SHA1
7f0c781b03c23379c0066f1aa5098bec5a82291e

SHA256
9b516d4ce4f0d8b10b2418bce73b275f4275799446f99c4fd0c02d089199b713

SHA512
b9f5ac7b1a7a4cf6b90eb81088886e92fe8c8acc7a71096a6a361f7f8af9e8fd1b00d8bcf63e35badf3756af0039704f59ea208403c161f68d166d1245eb9abd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5a434c092b656fab30bfc94dd87759e3

SHA1
48e463627482ec892af8ba89b2f4b69672cb85a4

SHA256
b3cfd6253f7419883fa3961c412acefbba35af318b6b929980a73e72b695d4f3

SHA512
86b8729a599a24f6aa69206b419e6b3d8003b382acfe5794f67723c53dd59408ec21d0ce330538d483dd3b13a3ac6b639695adf60a21db99f40783df736ae701

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a102381039a9035a5192326bdc5050c2

SHA1
3a93be37abff9daf37b2adde5f33c44770eb83a8

SHA256
530bf6721f420a56e7e86f42f28a2d3df6b50abb8ad0ed963af94ca6ef8ffddd

SHA512
5bb0c3dbc5b6c84ed7f9939c4ffb747d507ca1ae10349bd1612fee21bdc2a1a95620489674f11c17788e2f51f7be277dc7799fc19b9aef09a5a491181f48c6d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6d6e36682534a0c5e8a2880ed24578e1

SHA1
89b9b40a8c7acda517d0eff32381ac17ed178ab9

SHA256
858c758ad99187b2a1d85156316d3cedf6583b4d0a1379884dc742a5a171824c

SHA512
35b2ae796e73787ffda5b6963a23e772d07a773cc79f0ad07e7e0d1779d44c450fc97a5bf1be16cea69b21cb6ae05388451db7cd8b0edc4ae76ddb72c34a15e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7e323852773d4a5754dd9363647cb16f

SHA1
b9db4dc308a5ff603547295825fae7ff6be851e4

SHA256
f74017245d4c575c86755124b1cc410c7207f9082cea0092a1452a96b717bc77

SHA512
c5fbef7c715fbc90894f8e174bef81dc661099b50461c8df9c36a84d6cc5351aacf718303a86e3bd433baa91539dba8a87cb5c18580e5927bdd9961bc82e0712

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
5132bf78a7f51d7cc5758d9b853b027d

SHA1
15a16458c9fc91541dc049b3f456f555714ab656

SHA256
19cd13657b5b581d1ccf42cf6480325bf8d71f1f87646a1aa2abfec2116062cf

SHA512
8b71aa88200e48ec6f8a6fe20b12492f1699f66cf58ecf748376c263f685c06b5cfff1a83f8c7b874a0e9acb719db198a969d515366017ced641dc73e800e165

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
ae2189cbe281b977cc1a7b42c0ce2f70

SHA1
9654fc165b2df8dc1528fefc533c79f5e617c3d8

SHA256
63a3621f030c19f24e6b9e25dfb0d5bfb23657bd55a057a1daef26768af2c0cb

SHA512
50e9d4838d8b4046163d5813ab14a0955271203525b4aef56a677ff7da5c91ec436c9ebfbd4e0059a2588bfe0813af034454e02fa30b111aada76320961dc5c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
4ad1b62c1842630273d9975fc5cc5bbe

SHA1
cb16c206f0a0686b55c67053e19436cf9fcb5faf

SHA256
4204000645cac0ba631e1f3d7bed28c49fb4fdb7c97bd788fa3e883e479edb8b

SHA512
81ae3ec771bdf78f6020453cb9c269212f9fa41d2599589e80f67fc1ecb60ae3c55fb2fe290d6ffa5fe455025e02aa18bd8739f48da5ee92b60183d7eaae46a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
102KB

MD5
3fbf691af4e5de70f25904fa32aaeeab

SHA1
f68846da198e7b3cf3cc23aa076094f630c66596

SHA256
6e3d47d8a625b33ac653f9e92b47f96fbb7d1e7f3cd260ceccdc75027cde8377

SHA512
2c8639f8a0c4413d87d005b9c8951f055778eec217b53f1720d2f4ba7880cbb613311ce45025fc940dc5a7024c13f5ea42abbcabeac179ed27ce352311fecafd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe583da0.TMP

Filesize
96KB

MD5
bd76d9eda28c9d844b3513d8867c9714

SHA1
d14fd778563fbae87053b41f5d77e269d6f726c9

SHA256
0b7edeffa9e95a247536fc6fb1caac0d90adb7bdd39a4fad077a8f4b6a656098

SHA512
47d8cbf32b0550cee681facc11c6941d863e45505387d7cc3340a59ab7e740f495ce45a3ff7571c5524cc080aef299bbeac30b298b1cc938685ec4dd01379766

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C52098XD\KernelDRV[1].sys

Filesize
14KB

MD5
a884ab4c1edd178b6907d382e36725bc

SHA1
08d97ddfd6e7316e9a3db8d292811ec091616148

SHA256
6de4a54b0a4d6132f3bae37df1392be40dccfb2df71d57d33aca24f8783ac609

SHA512
fe344e09240401b6ed9522d7664490c20cf97318bd85c7882e1f93aa700804be001ce14710eb08d07883602619a5eab1837573964121d70de69bd4ccee9e35e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C52098XD\sclolrat[1].bat

Filesize
855B

MD5
ece2939ad25113b64f41e1f59c0b6e70

SHA1
2170a6d2b173bffd776d20385bbc86cec1f776da

SHA256
1a16fb2e456ed05de6aa53e58b7aeddba522af47670fd5fe315952a02aa1891f

SHA512
f1936a1ae852ca16d20393c90b64d5c48367ec2e1440a313bcfaad3a9e0cb0958c46cd22dc32d9aff4322f86376116752f2d2875cd4c47fc39b5517ca1f2d922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7TWCMRP\NetFixer[1].bat

Filesize
2KB

MD5
189dbc488495dbb7b4bc313bbf777116

SHA1
476e49b7383544e7f1e5d4c080e528fd406906d1

SHA256
6b564fd712451bab4446c4beca68635843dfbbeb38a3430b162098e9204ce40b

SHA512
ae6464807f10f4b0ca869c253b7036ae5e7f14b24e8079f8a3481816e4457e036747fdfbbfa26c9f85795f7dcb57f1e839811a327f326799bdc5b5820106c38e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MF25FY4A\driver[1].sys

Filesize
901KB

MD5
591b99be71c9c6c7667b0d7fb9c34b5e

SHA1
919d60a0955b592819b6cdcf9fb3c1e9b88372d1

SHA256
fcb83460f68e3ec9a5efc1ce873417ad8715f420e422d629b62aeac4ed34f807

SHA512
a469efb0fb834c634520d84fd4685c0960ad2f2b044b57a596186635066ea313c627777efa96cc69ffe0d28ea6e88e58257c2ab4314f6f21cd1bf7a9c3cfc895

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MF25FY4A\pc_name_list[1].txt

Filesize
2KB

MD5
c6b52fcf7549522450608aea9f374411

SHA1
405b10c1c668081c742a7d2a7856ce273fee493f

SHA256
192fcaf861054d9463379ec211ab450f7a8406ce0302b7073b68c8e742bacfa9

SHA512
7b101443cf8c4eee302961a8c0be9729f87409391f7f7b288104a8c374f97c57491518ee55029435c7445bf79ecc2beef06c8d5a9c3793558bafda7cdcbb630a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OCSF5S5B\pc_username_list[1].txt

Filesize
1KB

MD5
b81225da913287b2800f4e204bc824f2

SHA1
5da7494f895af85b7243a7329debf200bddbf8e6

SHA256
b613333592c1ee02923d04f3dfa096ec83f1f09a5fddead9725a8eca46c065d5

SHA512
c20586fa39e1fba13f72664efc78d6123181ed6366e152b4ae813cacafe9081106e49cfdf0fceaefffc2e3d5dab0aa891bfe9b97dcb07319a2dd847cbbbc3d46

Download Submit
C:\Users\Admin\Desktop\loader.exe

Filesize
545KB

MD5
5a8c4e69376ce15ea3a659211afc9ea6

SHA1
4f3d622bebc61f36a4dfbaedeb33ef713b198353

SHA256
b574a49f0682b725bc9e48a213251c517ed9a25a3f6ba03aa7f588287474e3b5

SHA512
a581648b6bdf17b9d019c79c20ff75f55aaa74691d0c6be568df55c7d9aea60ada25b0e0cea6bfe2a81a7ba7e5940d12a352a8174eefc9037f844ee252de6eca

Download Submit
C:\Users\Admin\Downloads\Release.rar.crdownload

Filesize
238KB

MD5
b76586851ed8ea2694f2de326130aa7c

SHA1
f8088a8c058030f2c22ae1d2c49f1a59d69fe720

SHA256
14e95b1807ce526b71fa9c2003d0a2954426dee6783de65adcd72187871185a3

SHA512
1421bcba0263e2fd5dd10a459d26f7e01f0f432d89a94799e59fcd76e691d122be40b79466ae736be7ea6abc538f457b8a9144655585d41bf4c7ff2e574dc08e

Download Submit
C:\Windows\System32\mz.krn.exe

Filesize
119KB

MD5
324330f343df4ac2f7f20db2c15f5e11

SHA1
835f87e709702252065348bc7cf2f5d531c2ba38

SHA256
b84a7b9233e5f6f2182535c0de85deb2375c6218fda5070b624710fcd7e74878

SHA512
ec8c085a0305b72bade63f020df73dcb79da736418ac0c70d9dd4fb79415a6d6e5dd78d733e06062019f6a28412295581774035aae4a0aacecbcd703c53f71b9

Download Submit