hxxps://anticheat[.]ac/download/

Resubmissions

29/03/2024, 08:30

240329-kea3gsdh92 8

29/03/2024, 08:22

240329-j9jgnsdh26 8

Analysis

max time kernel
299s
max time network
298s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
29/03/2024, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://anticheat.ac/download/

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
4348	Ocean.exe
2832	UEle9hTTS4.exe
2340	xxstrings64-Ocean.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	UEle9hTTS4.exe
File opened (read-only)	\??\P:	UEle9hTTS4.exe
File opened (read-only)	\??\Q:	UEle9hTTS4.exe
File opened (read-only)	\??\B:	UEle9hTTS4.exe
File opened (read-only)	\??\G:	UEle9hTTS4.exe
File opened (read-only)	\??\J:	UEle9hTTS4.exe
File opened (read-only)	\??\K:	UEle9hTTS4.exe
File opened (read-only)	\??\M:	UEle9hTTS4.exe
File opened (read-only)	\??\S:	UEle9hTTS4.exe
File opened (read-only)	\??\U:	UEle9hTTS4.exe
File opened (read-only)	\??\Y:	UEle9hTTS4.exe
File opened (read-only)	\??\T:	UEle9hTTS4.exe
File opened (read-only)	\??\W:	UEle9hTTS4.exe
File opened (read-only)	\??\A:	UEle9hTTS4.exe
File opened (read-only)	\??\E:	UEle9hTTS4.exe
File opened (read-only)	\??\I:	UEle9hTTS4.exe
File opened (read-only)	\??\N:	UEle9hTTS4.exe
File opened (read-only)	\??\R:	UEle9hTTS4.exe
File opened (read-only)	\??\H:	UEle9hTTS4.exe
File opened (read-only)	\??\L:	UEle9hTTS4.exe
File opened (read-only)	\??\V:	UEle9hTTS4.exe
File opened (read-only)	\??\Z:	UEle9hTTS4.exe
File opened (read-only)	\??\X:	UEle9hTTS4.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
76	ifconfig.me
77	ifconfig.me

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\WF.msc	mmc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133561741359421509"	chrome.exe

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	UEle9hTTS4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	UEle9hTTS4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	UEle9hTTS4.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3264	chrome.exe
3264	chrome.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe
2832	UEle9hTTS4.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4348	Ocean.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
624	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4348	Ocean.exe
4348	Ocean.exe
4808	mmc.exe
4808	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 4816	3264	chrome.exe	73
PID 3264 wrote to memory of 4816	3264	chrome.exe	73
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4288	3264	chrome.exe	75
PID 3264 wrote to memory of 4868	3264	chrome.exe	76
PID 3264 wrote to memory of 4868	3264	chrome.exe	76
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77
PID 3264 wrote to memory of 2772	3264	chrome.exe	77

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://anticheat.ac/download/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa34c39758,0x7ffa34c39768,0x7ffa34c39778
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1772 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4304 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3740 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4748 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4576 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:8
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5392 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2984 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5520 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4616 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:8
  2⤵
  PID:3112
- C:\Users\Admin\Downloads\Ocean.exe
  "C:\Users\Admin\Downloads\Ocean.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4348
- - C:\Users\Admin\AppData\Local\Temp\Dsnx5QEd4\UEle9hTTS4.exe
    C:\Users\Admin\AppData\Local\Temp\\Dsnx5QEd4\UEle9hTTS4.exe 324847
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Dsnx5QEd4\xxstrings64-Ocean.exe
      C:\Users\Admin\AppData\Local\Temp\Dsnx5QEd4\xxstrings64-Ocean.exe -p 3248 -l 15
      4⤵
      Executes dropped EXE
      PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4556 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:1
  2⤵
  PID:304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=2052 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=840 --field-trial-handle=1840,i,15207864764854236021,16396786412538751039,131072 /prefetch:1
  2⤵
  PID:3988

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2408

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4808

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:2756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
198KB

MD5
cda68ffa26095220a82ae0a7eaea5f57

SHA1
e892d887688790ddd8f0594607b539fc6baa9e40

SHA256
f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb

SHA512
84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
a76ec806f0ba3e660049225c9abf4cf0

SHA1
dc87e406dc9591ea9088efc4333eee217abfdac0

SHA256
805d9f40951a5cd8f5f60da145c51d9a2c699bbd616a79b61be518605a77104c

SHA512
87e7b69a1056a27ae03d5e05a412d2c4c249546fe7fc27d8d574e5fb2159e243e6ec9d042d5966834ee27da3ce8c72d39e18a54f5af05803a406f85a9dfb94fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
d713e4905a52ae5dc48cde4b87408eaa

SHA1
e5476f7cdcfb454689c0a373fd858dabd38c187e

SHA256
beeeeb37693a5742e3d57ce94d919ddf000f3a37db9b641c6f0e59307e98da92

SHA512
3f0aca238f209b8d6f3f89cedbd6f992f1049b8cfe4eb66a7c04f94c69762d6d1b1f67058ed3517fd63c3b21569daebfed8308fc56286de60a14764eaa9635c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6f19358c-6c5c-4d59-845a-27eb48483f6a.tmp

Filesize
2KB

MD5
4caaffc8e41ac7f4854c94f412068237

SHA1
51ff06b0899d66f17b7e4acde86c5a5646486719

SHA256
a195599c1b5f0093f2384db0d1729b75655ecca1b7e1d08fd949bea44b7a10e7

SHA512
5b3cd8b34894a334043d80766ffecd363a7dd157868d79734b2aa531846f1ab1a0e15da9f982ffc2887d911441eea8408f640204454f7afead0e7b3949ed3183

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
3342093c251a619c62bae52150e7b0e0

SHA1
fb8d96e602ff71e2dddf884c261a1f1d602617f4

SHA256
e7618d6b3cf199e98d77b8716f2e14c56c37e557ca03831e01a8f9308fa3644c

SHA512
ea33bc266c8df3c8c30d734ea58fbf87fa7909d1d9b78868d50b78a601850667f4003b3d7e429891ba1317f1e23833246f2d9c67fe4a83f845314f6654a4c119

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d40c569d6373f7f8e7e3d6b47719ab91

SHA1
45ef6a4a35ce9eaffb83d1ff8456df8e0fa9cde6

SHA256
c9d3f1d6dc0bdce4c464bed56eb2da3c9cfd6b3da086b5a26bd52d6c0f702890

SHA512
e3ddd515ed9922725fed065e068d5e967492a4cc6149dbccf956daee6827d8c62c209a61306820959c9780d4d14ae8ba2c3c76ca65a67208d20f6de20d1d4b4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c4e7f5e476daef2ebe30c98f75dc012b

SHA1
0f6737d64544e46c525d413fc60e12362f51ac2d

SHA256
a3f401568d3ad1bed1e4e741d04222ea4bbd487d0c0247293495471aea8333d7

SHA512
eaed332b684cc1d21c1070030f6432f5b26a7a46765503bd022af072ba3f8c46edea2525fad79a4313fdd0295c4106acd2b1b7ed71cf6fe5e8d59b3a8bc17be6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5e611093bb18bb9f390bb46b8c0af8b3

SHA1
8542d834f0b9f9cddefbac5a56fa0b01cee04040

SHA256
b3ec64ec5f07d2e0c1cf5387a4c5cb715bfea92c064633a938808ed482955aab

SHA512
f40600934f5f1f5c4dfc06a1bea869de41748433303efb4993893e56c625aa695f490a3f3e065e4d47373730f1a9b8274c59fa91117aedf506280124dce75c55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
cbdf2158566141f5b9efc41472407d41

SHA1
d1d48fff838faa09bcd4fcfdb6f7db765cabdfc4

SHA256
bf48b9882af5dc6296dc4cc09bd42cf9f2aa6a9b00bc65152db9d8886f190163

SHA512
6b3262d9b454388cbfb77e2d535db5e9970a31ea773e3c5094216f3a6c3962bdfa592c881d05712b3df32e1907f9cc6974f05ba0f29500085026228adec62c4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
1519953b4c34ef4a35c8dbc5c5a0ef6f

SHA1
26d816be00d2f3e53700bf907368e390d8da9b12

SHA256
88d8bdc166a1bc09be05c37551959c1d2737fdd977d47cfd0a2a6b2171f70cce

SHA512
c45b5370539874ee1ea4f8e7f6019eed219cb23ae2ae6abaf9924f924075c37e081e276dd5f6114e8916902e1f6d98ca9c43e4251fbbad7494e519d59f747ebe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9c8c8d315a46f6d6b40182ba56c46727

SHA1
0d253d35e044b0b098b39e021cd8e3dd02f27645

SHA256
31ae990add9e3192db8ae9e8bbea45f4483790ffadb6d051e459328478d1df53

SHA512
76b1a664df870b1c7cba6b3cab33983222fc068067f8dca94c3cda8d470b4c9874ea48d6aa78697dfa0f4fcf682a4ba9888078e8d7e80b5f38aaf64d369d4a6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
15bc8a6bf0df4ad6de7cd69e663d7768

SHA1
5f05e591d1b35c55f0f2108482695f16643f6543

SHA256
5168e5b1c6b966e7c647d4c7e1716e87b4c127b46bdd44da7c3ccb59221c66ef

SHA512
324615ff15159028629c8b7e3fb997fa3ab638d0d344553a7c4df4fffdb1953febac3a460c6e9d6162a4d5d60312e7e2bc88cd58845aff9ba949e77a56a6a4d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
766c4cad6909445e9d73a52ccc7fc138

SHA1
c15fdcc0c815b0bab4a24fa8abc6c6239781f12f

SHA256
7f55da5764a96c77c46d1c245e032a1a8c7c78ad3757b17df7d7340360d13f71

SHA512
d6c8ad61f8c1927ce87770ff1e0e5e69954ddac2ec37370a0c6479e7d5cace7e005ec29b98036e755efd1be1710202c9f6d302c814ed65af7f768317deca5e17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
a4a438e5b85fa04bd827919f16e17007

SHA1
8e7ac6e3a16ec73e24e70755b06c14dcde54602c

SHA256
0b41e1b0cf0637d12829ff71787855bdfc86345723c620a19bb07843a609defc

SHA512
985bbf36ca780524903bb021088de85f444dd69d7c04d078cfa99ad36b455db1ae451880427d796fbd1b8c3e7deb184bbb58ccfc4d02fdb03a1e9e710f6fc51a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57f2eb.TMP

Filesize
100KB

MD5
9e51bd24a5e0567dd3c60f058d8a2d86

SHA1
2bfbd8ec4423330a56c9bfa7cf2a696bc79fe6ae

SHA256
077137d0e5b923de7bd2c79654468ea50d988fbc3ec19325eac446ad459621ab

SHA512
a577b29c179becd5757157f025f6d646f5921a3f683ddbace0273179eb045c01c12b02cf389d5d67989f233547b0dcbddb75c17a1a3280ad1cb73c56f8f5f2a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dsnx5QEd4\UEle9hTTS4.exe

Filesize
6.4MB

MD5
bcd87215b5284638e8fccbdd2bd7bfdd

SHA1
646e65dbd714d7691f519c38f396c77fc9adc578

SHA256
15eb612e3a7679d0f0762b65eec87ee5fa4be68a271cf78f40adf277599e4a8e

SHA512
5801c4a0481bb8653d210dc6121790b7a01c4c6fb2ee97643750eee0d704181df83e3a4be38816d744918318a3986bece9c0b0aec116dae1cabc2542f0a5a2cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dsnx5QEd4\xxstrings64-Ocean.exe

Filesize
25KB

MD5
d12ecf58a06d888f5d8d54aa28ece7ef

SHA1
6822e1a67a04f5c5e6c1b8986895bba996a83a0f

SHA256
ab1369fe925f98cc70d67b8270168dcd2ddba907a807ebbac126d20b2d71dfd7

SHA512
c3e29908f9007ba8cf5c59a9a3c25e8a2bef085b95bbc559843bef90fad916b9c0fa3f1b044d648c73d2d7bf8a1e56522524001c4d21932ae2d5629c5694ffbb

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 833821.crdownload

Filesize
2.3MB

MD5
a77ce0ba1c61498909b758e7339f9555

SHA1
f3ad2db5da508ca72350da49cb806190c5cd0481

SHA256
3656a057e83dba2d55545da90b88e029f74ff4ceef6dee684443d245e1bb0d9a

SHA512
de35d38c542d410c897e1a7cbbae5c0c6044ad541dfd816b507bf9814085df2f66bd32ca212d52038627d9a957974c7b46dc52c1bfcc42b496e5e521600254c4

Download Submit
memory/2832-204-0x0000000140000000-0x0000000141131000-memory.dmp

Filesize
17.2MB

Download
memory/2832-170-0x0000000140000000-0x0000000141131000-memory.dmp

Filesize
17.2MB

Download
memory/2832-171-0x00007FFA3D8F0000-0x00007FFA3D8F2000-memory.dmp

Filesize
8KB

Download
memory/2832-172-0x00007FFA3D900000-0x00007FFA3D902000-memory.dmp

Filesize
8KB

Download
memory/2832-174-0x0000000140000000-0x0000000141131000-memory.dmp

Filesize
17.2MB

Download
memory/4808-242-0x00007FF6CE890000-0x00007FF6CE8A0000-memory.dmp

Filesize
64KB

Download
memory/4808-250-0x000000001C7C0000-0x000000001C7D0000-memory.dmp

Filesize
64KB

Download
memory/4808-251-0x00007FFA1EEE0000-0x00007FFA1F8CC000-memory.dmp

Filesize
9.9MB

Download
memory/4808-248-0x00007FFA1EEE0000-0x00007FFA1F8CC000-memory.dmp

Filesize
9.9MB

Download
memory/4808-246-0x000000001C7C0000-0x000000001C7D0000-memory.dmp

Filesize
64KB

Download
memory/4808-245-0x000000001C7C0000-0x000000001C7D0000-memory.dmp

Filesize
64KB

Download
memory/4808-213-0x00007FFA1EEE0000-0x00007FFA1F8CC000-memory.dmp

Filesize
9.9MB

Download
memory/4808-241-0x000000001C7C0000-0x000000001C7D0000-memory.dmp

Filesize
64KB

Download
memory/4808-239-0x000000001CD40000-0x000000001D224000-memory.dmp

Filesize
4.9MB

Download
memory/4808-215-0x000000001C7C0000-0x000000001C7D0000-memory.dmp

Filesize
64KB

Download