umbral | hxxps://oxy[.]st/d/KAKh

Analysis

max time kernel
345s
max time network
334s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://oxy.st/d/KAKh

Score

10^/10

umbral persistence stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1216825038481784942/qp9K1mwYdxJZ9SzOI8xlhuZXMRxdMvg1AXbmrg9XHDjsfACHvJLEopFFNvTczk9RZTza

Signatures

Detect Umbral payload 5 IoCs

resource	yara_rule
behavioral1/memory/2892-2191-0x0000000000400000-0x000000000051A000-memory.dmp	family_umbral
behavioral1/files/0x000a000000018b33-2201.dat	family_umbral
behavioral1/memory/936-2213-0x0000000000F00000-0x0000000000F40000-memory.dmp	family_umbral
behavioral1/memory/748-2255-0x0000000000D70000-0x0000000000DB0000-memory.dmp	family_umbral
behavioral1/memory/2600-2285-0x00000000003E0000-0x0000000000420000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Downloads MZ/PE file

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe

Executes dropped EXE 10 IoCs

pid	Process
1356	bolls.exe
936	Saransk.exe
1696	xray.exe
2036	svchost.exe
1000	bolls.exe
748	Saransk.exe
2680	xray.exe
1996	bolls.exe
2600	Saransk.exe
2968	xray.exe

Loads dropped DLL 10 IoCs

pid	Process
2892	Emperor.exe
2892	Emperor.exe
2892	Emperor.exe
1696	xray.exe
2736	Emperor.exe
2736	Emperor.exe
2736	Emperor.exe
2560	Emperor.exe
2560	Emperor.exe
2560	Emperor.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2020	chrome.exe
2020	chrome.exe
1356	bolls.exe
1696	xray.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1696	xray.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1696	xray.exe
1356	bolls.exe
1696	xray.exe
1356	bolls.exe
1696	xray.exe
1356	bolls.exe
1696	xray.exe
1356	bolls.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1696	xray.exe
1356	bolls.exe
1696	xray.exe
1356	bolls.exe
1356	bolls.exe
1696	xray.exe
1356	bolls.exe
1356	bolls.exe
1356	bolls.exe
1696	xray.exe
1356	bolls.exe
1696	xray.exe
1356	bolls.exe
1696	xray.exe
1356	bolls.exe
1696	xray.exe
1356	bolls.exe
1356	bolls.exe
1696	xray.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
1428	taskmgr.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
1428	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1736	2020	chrome.exe	28
PID 2020 wrote to memory of 1736	2020	chrome.exe	28
PID 2020 wrote to memory of 1736	2020	chrome.exe	28
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2596	2020	chrome.exe	30
PID 2020 wrote to memory of 2436	2020	chrome.exe	31
PID 2020 wrote to memory of 2436	2020	chrome.exe	31
PID 2020 wrote to memory of 2436	2020	chrome.exe	31
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32
PID 2020 wrote to memory of 2744	2020	chrome.exe	32

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://oxy.st/d/KAKh
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6cc9758,0x7fef6cc9768,0x7fef6cc9778
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:2
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1476 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1572 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1472 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2200 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1468 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3272 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3480 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4056 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:1
  2⤵
  PID:612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2316 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4384 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3320 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4236 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4228 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4268 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3652 --field-trial-handle=988,i,13366268747846740760,8953407660731082331,131072 /prefetch:8
  2⤵
  PID:2608

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2888

C:\Users\Admin\Desktop\Emperor.exe
"C:\Users\Admin\Desktop\Emperor.exe"
1⤵
- Loads dropped DLL
PID:2892
- C:\Users\Admin\AppData\Local\Temp\bolls.exe
  "C:\Users\Admin\AppData\Local\Temp\bolls.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1356
- C:\Users\Admin\AppData\Local\Temp\Saransk.exe
  "C:\Users\Admin\AppData\Local\Temp\Saransk.exe"
  2⤵
  - Executes dropped EXE
  PID:936
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:2956
- C:\Users\Admin\AppData\Local\Temp\xray.exe
  "C:\Users\Admin\AppData\Local\Temp\xray.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\xray.exe"
    3⤵
    PID:2044
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 5
      4⤵
      PID:1592

C:\Users\Admin\Desktop\Emperor.exe
"C:\Users\Admin\Desktop\Emperor.exe"
1⤵
- Loads dropped DLL
PID:2736
- C:\Users\Admin\AppData\Local\Temp\bolls.exe
  "C:\Users\Admin\AppData\Local\Temp\bolls.exe"
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Users\Admin\AppData\Local\Temp\Saransk.exe
  "C:\Users\Admin\AppData\Local\Temp\Saransk.exe"
  2⤵
  - Executes dropped EXE
  PID:748
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:2696
- C:\Users\Admin\AppData\Local\Temp\xray.exe
  "C:\Users\Admin\AppData\Local\Temp\xray.exe"
  2⤵
  - Executes dropped EXE
  PID:2680

C:\Users\Admin\Desktop\Emperor.exe
"C:\Users\Admin\Desktop\Emperor.exe"
1⤵
- Loads dropped DLL
PID:2560
- C:\Users\Admin\AppData\Local\Temp\bolls.exe
  "C:\Users\Admin\AppData\Local\Temp\bolls.exe"
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\Saransk.exe
  "C:\Users\Admin\AppData\Local\Temp\Saransk.exe"
  2⤵
  - Executes dropped EXE
  PID:2600
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:2468
- C:\Users\Admin\AppData\Local\Temp\xray.exe
  "C:\Users\Admin\AppData\Local\Temp\xray.exe"
  2⤵
  - Executes dropped EXE
  PID:2968

C:\Users\Admin\Desktop\Emperor.exe
"C:\Users\Admin\Desktop\Emperor.exe"
1⤵
PID:1508

C:\Users\Admin\Desktop\Emperor.exe
"C:\Users\Admin\Desktop\Emperor.exe"
1⤵
PID:2896

C:\Users\Admin\Desktop\Emperor.exe
"C:\Users\Admin\Desktop\Emperor.exe"
1⤵
PID:1808

C:\Users\Admin\Desktop\Emperor.exe
"C:\Users\Admin\Desktop\Emperor.exe"
1⤵
PID:2508

C:\Users\Admin\Desktop\Emperor.exe
"C:\Users\Admin\Desktop\Emperor.exe"
1⤵
PID:1136

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C

Filesize
579B

MD5
f55da450a5fb287e1e0f0dcc965756ca

SHA1
7e04de896a3e666d00e687d33ffad93be83d349e

SHA256
31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0

SHA512
19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
4977ca11d034646faf5a64be43b65125

SHA1
8482247c10ec58dfb779fcbf65deff33d66316ec

SHA256
f4f58135878962e2df60fe8f91131d4c1235d15a3d151064eff104278a2581d9

SHA512
9c8d2d5332eacb243ce96c47ec34575558cafc52f61a272cf0dd74bd81fdb7081e7c5bbebee753d60628150dd5e35fbaf18c801f32439de0be18e5b67b820f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C

Filesize
252B

MD5
52081f44575957da5a088574d8679e28

SHA1
363f7a084305378b553fe0114e126b185456ad43

SHA256
5c143bea661a21ee8ea9db451e7f06d707d97de2b78dabe104dde26ec8066d36

SHA512
07df026e1680deeb75cfb8f8732d5d2b32ccb74837f7c46b992a9a2bb5b8d85ea03f6f99cd045ab049ce824e9496598bee1555f9c76d6ac377e5e3d712e07f08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3566ebd1955163e4980cf2ac6a3ba38e

SHA1
a99f4a6649b39a0535ec00da790514e205f4b605

SHA256
104d30cb4f3d88e42c1c252ac027d7f5641b4446efd79916e3da3445e12c96bf

SHA512
dcd1ae45513e8cd70de434d0c3a8b7b2f31d32770d27d0840fe3f604b1db056d0015bccbb64ac9af93e99f16bc80f0fe919c63af06c591509d5666b3c339ac60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d290bdc4f2f5c21983825dd68e8da0cd

SHA1
d34cac8ce2890ca069c853372108955b2a0591f0

SHA256
95b866d309d956cfb2ab944ee81bf4e235db315d961b6bb6ac2110fe5d046f12

SHA512
71e5158a1adf5828fc3a638fe7b6c04f20822537832b64084953852e939b9648de5d087f49b0a148b51fe9f2bb13c8f8991dbcffc6b98846c16a16cb6ce162c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2b4dcfec9d200dc81573151667e5c67

SHA1
cba5c089ca49e557b3213be75560dc090e6c338e

SHA256
2f5366ca8f68e2aeeb83d76ffa5323ce1cc704cf94eaba5e51e7b1c167c768a3

SHA512
9f1254393c7f258edd373a535ed9d1d1988bff9eced6f156714fc25755e075620ccc6fbe8bca300f784a40dbcb8a81ea59afe927b81e9868aa6b5151653c376b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59aab051698c8c614e517d9bb477dbbe

SHA1
6d12cec0e1cec31c0b0be26723e0325427da22df

SHA256
a3f9ba12195f4c6db95107776d0af0a47ec79a90edb6f46a0e347f2ad74e4c85

SHA512
fc9ae6ed64491a32368a94cc14e7add40536a03b454d9bc4765ad06ebf911e8f7670c107a06f14a6e0fb06712a1e577f6e05111999ae30da6c423b8b1a01aff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23106aecd65341ae5c02daeabbb6fd91

SHA1
ae316264ed773f55bb857e1493bb59b0e947c9cb

SHA256
094bd6c172021e7a70495d059a9f0fbf0e175b1ef56b57ad8ac49f0bc0c9150d

SHA512
36fa78b0f8f7e62c27246857155e4dbb4be6f332bc84ff5d62cca85c4a7e96f3fd90f7d9effc96f4f4c01ee2a355da5bd643236673cbd26a66c347cfe8b7879d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f4f33fe6f5fa4faacddd15f5cab2a6c

SHA1
ae72c596e09324255f8f690432930f2673d6ebda

SHA256
d97d46a3e08449214c1b597a546a5d783a9e0b50d29c2fcb977e5491406c46d2

SHA512
f4a6811026cdfdbc138864f69042a457cf045bd666474f7a6513cf5ef3418231054f491d7ff0cbf4fda8e8d44d0f17bb20862744472399e9c9927c588aa5dcdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c52ec1ccdebc2cc4c73bfcad1130ed1a

SHA1
08bcc43d287a6a290984628723276e30ad90b98a

SHA256
61e9e21708d7276e16fce40118e19b00918e5e999a068e829988e5f1bfc5dc7e

SHA512
9aebd10aa533c548e5488c3746ce71196601744062d950dce711661d0a71170be78b4bc7501f590082f4064af042cf441224e1c1eb4e3f803b3fe101ddb7a425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ac8d60c75d7a4d56f278ad8b1034816

SHA1
4353b54380b16e392c943e2ced10c901e0786fa8

SHA256
e5085fd5d48174688aee4b32558e7a8b3addd3110ab4c14e56c4dca3e58d563f

SHA512
65dfcc1fc9bc3cefd447af47b4e64eed938576dd200c92f0a67f32fad6298586b26b3844ce9e19fd8f34d3ed22db6fc6e047999800db0409713b698f81b4ae46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6fec49411c645470a88f9daebe054e2

SHA1
a56e0c65eaf6ef726bef3265d97cd3a96f88d20f

SHA256
5246800e621605713a00e761defad4b9dba2a593df79cf8e177dff793d7290d7

SHA512
d89fbf9fd62d61e2a74b4b1cdb6ff90c1e48570d4e4cc456ec0c2c36072df6da60b80fb68c8b220ca8a13768229e22e8d5edc66000d70fbe124c13ed56bc4685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59865d53840832dbecaea451464f9e5a

SHA1
810e99f7128ad9fe28f21c4a2f641352f78189d3

SHA256
0ded317bf40566af605e6be42b90fb75d219108bb49478deee085f5dd70768b6

SHA512
757939bcd2c886470b52e78927d61c6621a601350a0db44cf5a9c5a4a0b81cd71c5211d5b4699e29cca0dab277c43c8afcf333794ff1411786c4c5194516efaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bc2a048558c326825429df5691ef0a1

SHA1
179772f7fb7aa21ac8f61b3ff478325005d10e40

SHA256
d3541edfcef3ca553fcf56cbaa77dc7594ec8ed9a55edb107c4dad659ca2c4e4

SHA512
dfc8b864ab458b93a633f2cba784fd812b8078b8737aab20e0fa1dbbcfb7c16dfe44db4a4cc1ef1a1de8e7e9bc872155ae73d16c73d2e1569214c2013618ac05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
053b3bcc3db735a158c0750c49d8f28b

SHA1
71369fcd315792bdbd5db6e176914f23adebba1a

SHA256
6670193aae39f117409e09493c0f8299e87116efce5a142cfbc71f8e9a67e497

SHA512
ade2ea17d1e3f37996fd9e0600537dd90179405f096aaf53e7d58eeaf92ba9b664b2f198f5cc88c57d5b2ca230dcfe531507e8a1dd2d4ddd5961d5ab9ac941be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d7535fed0012d69ede37b679682801f

SHA1
9ee820f97fdd42a507c804dcf17ce9e4b3a5ea6a

SHA256
6b523aea5f41d7bd29e73f2e99723d74862487c0a240776424bdd92cd6e49285

SHA512
abd6784555471dc6beaf4ecb444a8ec5d8511a1ba861d1332f5fe2895ec39116d4545cf5e51a2d04b6e62153037cff26104be80a5870976e0287aad8d05a4ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e24b74ee4ca3a8ca0f4f7be9703f7dc

SHA1
350f862404ef503a7be544f4c9c92ab53f62f179

SHA256
74886d657c8e4db92786126909b8382b9d51e962d91c35f347e68c2074119358

SHA512
3f79d5e449b6f6c2b3f23bb2ad01bc4237b6d616c811527f29566a84673f5419d89732d48e45a8c338d62b2fdfad5ebac0b5799688c7b4c7aeb3babc11cbbb0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8c4dcffaa161d60dce0cac84d67a78a

SHA1
43329d509095d3adc1b50402ff9533e43f980b4a

SHA256
510cbbbffbe39ecd47c15e5b5349dbfb1d574052bfb92ec4e9fcfb855a63bc0d

SHA512
3012134ebb91edfda623e12411995f51284d6fd5baed18717af0060193492d6d6e04c76b6f12188d7eb000d171e1c31f368d903daa00b062814275131813103d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
595a0bc1636c86d675cb37eb271398a9

SHA1
563432192cd87446b19fa1bf75e3073f0f00a292

SHA256
f39001c28a568c737f23ae975c3d05a396d67d211c371645dc066115cf25ccf9

SHA512
3f033cc2840880e4960d02701e94855e4f6d511790f7311703ac4a3d31da0fba5f467ee0d468802297ee64f73b2fdb269539c717bf7b98243f49c3030a25ea86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc4d677e1c55ca488f06546d220ad00b

SHA1
63eb751cc8117ece25e2b352ca390df1f58bd703

SHA256
579d452cf12fb1ad87fe70d4a8d3b63a6c13faa91b38ca52efb348adcdb01bc4

SHA512
543dfff0111e1831428e968ca0aab0af79e0332cc332e0dfcc2e5d4f91fa783bf341e865741693b663c7b52d3f1320113562601f7ca8d3aa47ad1284b6763461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d17803b7ebb9638be5ba14f0ed5ce3fe

SHA1
ddd70421703087fe7d4217b08a8272429594c555

SHA256
1b157c630b9538a35dafccf8f1889941ba348bc50b75d8335e13c92cfff06e62

SHA512
2dae3713d05b5afe9dfeeaf6ad71de4bbb79e75a93a9fec5141fa3a6744a1afb11cae8cc5c81290231a5035611bb94e63ebf547628a165549245b5d607fe948d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39fa064052b578afd4a567534b8ba53b

SHA1
a7a5a942833f87063ca586d71ccd0974d7244aae

SHA256
43e147f088105c0bfecbc75f226cfa18b6bc9f9621eff7568ed8781e82c6ec44

SHA512
4f45b44d0a288ffc4d71c669efee74b6d854568d26e0240e90aeb50ddd07665042d2d4af0b0bffb8fc6c87bdcac41ea9a14da501563ae9937fd6215aec461ece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b65999aa9f5fa8c31629e6ab9f2c39e

SHA1
aad77f645d14933868478d6240bb2dbf30c0a58d

SHA256
fb4d89bef1e6f8d586c40394bba64b786b23a6ce3aea4d5ddecc149b2c172e96

SHA512
220c508ecf111000982a18307e742e87779fd370c7ffb2df04b4a62bc32665c6882d6e619fd55f0bfbea9075348a14e0aeeb134607d4b5cbd981b6ee0490d96a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
fe749b3e8e04f57025edf85608a15756

SHA1
516bcbfb3b4808ca7f748acf58770fe503eaac2c

SHA256
9c9fe0124d4ad5197de201da51ff39807f1224ccaeaca618c5ad317b2b8e4480

SHA512
89d2f3483c51049a6438e41dfb7b2d8d3f0552e0b5f3eccb97f6d319147dca48fe588626107e6a76e223db834db07ca2612b4b1537bfce8c6fd4582811356c82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_download.oxy.st_0.indexeddb.leveldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_oxy.st_0.indexeddb.leveldb\CURRENT~RFf7679a3.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8561403454d682a48527f9d2d34acd13

SHA1
69e1edc343af4f304ebeb5984dc38dbde0b43d62

SHA256
fc360a9dca4d3d6b5edba4b1a91b3da6edd50b65a8d972557433529757394c35

SHA512
0a82d96e5cb8dc17011b831c3e0180753775f20afa6159a833abb396f8da090d108ebdc2921b8e39e1d59bf9fafa2445aeb47325dd46abc5849fe3c6d9f742e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
547d79671dc4f69d183d4c2bdbf81054

SHA1
28746a36b61264611647ba5452accb016e7b406b

SHA256
c9b5d6049024f41a8de2049517c12cac7d85851a90fffe513957d42d49e69b8f

SHA512
4fef951c28d18fcebd8526c48ec9f3b27e635be3211555b9181083dac33cc2a0c4912e5cc51953d2968044cf9952bd75f8ab5ea9f8cb371cdccf16b8b31fb446

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
2051c2934d50bda9d13ba719a21e6a6c

SHA1
007b2d4c68ec55f0e9402c0e1f9a9bc1fdd4a631

SHA256
eabc4755802459122e65679dbbabc5e131096b0cc7b0a3eaaa256c56f114f44e

SHA512
85a3117905884d6aafd82e77892c1409473d7fb09821683bb1580c642551ac65a9ceee43252c0310969323395db5d9fc741472b627c868164c004889934c7ce8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0940473657559ee5dbb2297b2fc83430

SHA1
76635237851fb0d860f0b11616f8088795bd9bb5

SHA256
eaabc2c3987780a160a6f8f15a495552710d4190ea4803c9bf2a069850aa62a5

SHA512
f28c584be204019f438b93bc8ecfc07680a81be36609dc1c7ac16f77111bfc5ec04cfd111f9736c07c9b0d2f4750b2329c21771780930b8ae689c41553e91e37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
50458f69e1abc6b72a98ac750ad6c1db

SHA1
affa9d1516ab633dcd62c01465e7397fb2b5d517

SHA256
b33cbae195a8d152a3657e9b0d2542c78e4eff2d910644adc0d906c1da1ec66d

SHA512
ed28682eb75d0474bbf50f5fc9a3f974e3ad7b521ab661e7b877e14d809b09276e34161e89d16c1569f9101ff76d7f9eb20e5dd09c2502f599bddbe052a2a803

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ddbef0c6-b8bd-4006-81ab-016abb9b9563.tmp

Filesize
130KB

MD5
af797a7f463dd5c37f38ddf4fd959e24

SHA1
c866eb7ae61606f12b2039976ca03723c44c71d1

SHA256
1d5aa8861bab06e15d354821776cfc1652cb2b1e190efeda11dd8347b1270b69

SHA512
0e112c0ef6cb2ede8a31f5167904244270ea3c923950882b5a378724cf38dd8a902cf0eaa1e552d0a70116ab6ed42136e28b4cbba4556d2b4b5cd995bf5ec63a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab760C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7998.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A50.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\Downloads\Emperor.exe

Filesize
1.1MB

MD5
d6530ffaaa8a22c180f960c0bb3bdb02

SHA1
f5c74b1a9a3f97d2f038696e7d2ecd9c553e7a7b

SHA256
e1bb10eacd76bd622d6ba1e9f8c3abf2a00263046f51d898b357dd4b25c345f5

SHA512
8a8f4174825554ceb633d52dfd5ef56c5d50f7b8e14f41cb9286c02b73b4b077cba9c01a4fce39dff38d92d076b6a5100ef8aea5e102a6f998167be8d6d22c34

Download Submit
\Users\Admin\AppData\Local\Temp\Saransk.exe

Filesize
230KB

MD5
380e359155e1e7e7fb63b4cc404f7d43

SHA1
9cf1b689be708ccc1efd3bd8f2c204871d1a9083

SHA256
87716661c7f573415e59bf07f8b609c7a9783f390116cc2ff5ac5f6d67d96c9f

SHA512
fb4f902eeb06fabe94e550ef1a3f70ace4bd0ed47ba82efd30626a997043a68d4c661a3aeac457ff4568c0c35a8f9d8888a00096641c32b32d394bc616ac1357

Download Submit
\Users\Admin\AppData\Local\Temp\bolls.exe

Filesize
248KB

MD5
4e46d93731395a27bbc943d90a5e9c63

SHA1
d55daa1ff5f52f71dc7947417b496684986bab6d

SHA256
c785a17d05184a39708dfe95c64ebeac0de7c212d3197febbf84e01902d81c4f

SHA512
566f3198fcccd40136a07ab450196505def1aeaf0bc70d391ec3f70bd249aeac50e9ca4364780d01a1177d0a861d337fb5f3edc0cb5dfc62bc04057f7a7f50fa

Download Submit
\Users\Admin\AppData\Local\Temp\xray.exe

Filesize
247KB

MD5
b4d7436a7913a9fd427b851818101ab5

SHA1
2b854d1d2c783b8e2fe57c219e5443ac36a01334

SHA256
7e8c6f536c555ec27199870a4ea0042894d5e03608d5a0278ba764e89f8f27a2

SHA512
f2b6af60faa1b16bcf37aac34df44dbd9b073cc3c31a768bb7f52b5cbe7ed023c746e4cae385968223984a5319ea667e6bee9ab2566b7fd9d424845c0ea136ac

Download Submit
memory/748-2270-0x000007FEF4020000-0x000007FEF4A0C000-memory.dmp

Filesize
9.9MB

Download
memory/748-2255-0x0000000000D70000-0x0000000000DB0000-memory.dmp

Filesize
256KB

Download
memory/748-2263-0x000007FEF4020000-0x000007FEF4A0C000-memory.dmp

Filesize
9.9MB

Download
memory/748-2268-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/936-2224-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/936-2218-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/936-2223-0x000000001B1C0000-0x000000001B240000-memory.dmp

Filesize
512KB

Download
memory/936-2213-0x0000000000F00000-0x0000000000F40000-memory.dmp

Filesize
256KB

Download
memory/1000-2257-0x0000000000AF0000-0x0000000000B30000-memory.dmp

Filesize
256KB

Download
memory/1000-2250-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/1000-2267-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/1000-2271-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/1356-2220-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/1356-2215-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/1356-2222-0x0000000002150000-0x0000000002190000-memory.dmp

Filesize
256KB

Download
memory/1356-2225-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/1696-2221-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/1696-2236-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/1696-2214-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/1696-2219-0x0000000002110000-0x0000000002150000-memory.dmp

Filesize
256KB

Download
memory/1996-2288-0x00000000021E0000-0x0000000002220000-memory.dmp

Filesize
256KB

Download
memory/1996-2286-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/1996-2289-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/1996-2312-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-2233-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-2234-0x0000000000370000-0x00000000003B0000-memory.dmp

Filesize
256KB

Download
memory/2036-2235-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-2314-0x0000000000370000-0x00000000003B0000-memory.dmp

Filesize
256KB

Download
memory/2036-2315-0x0000000000370000-0x00000000003B0000-memory.dmp

Filesize
256KB

Download
memory/2036-2241-0x0000000000370000-0x00000000003B0000-memory.dmp

Filesize
256KB

Download
memory/2036-2240-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/2600-2285-0x00000000003E0000-0x0000000000420000-memory.dmp

Filesize
256KB

Download
memory/2600-2299-0x000000001B0A0000-0x000000001B120000-memory.dmp

Filesize
512KB

Download
memory/2600-2297-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/2600-2311-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/2680-2272-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/2680-2269-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/2680-2266-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/2680-2265-0x0000000000C80000-0x0000000000CC0000-memory.dmp

Filesize
256KB

Download
memory/2892-2191-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2968-2300-0x0000000000570000-0x00000000005B0000-memory.dmp

Filesize
256KB

Download
memory/2968-2303-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/2968-2304-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download
memory/2968-2313-0x0000000072EE0000-0x000000007348B000-memory.dmp

Filesize
5.7MB

Download