rhadamanthys | hxxps://www[.]dropbox[.]com/scl/fi/tphv3iyn6y8j5h1a29r7j/TvkHack_v7[.]rar?rlkey=mpn3om9hxrhkwr6c9r3pk62yb&dl=0

Analysis

max time kernel
304s
max time network
302s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28-04-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/scl/fi/tphv3iyn6y8j5h1a29r7j/TvkHack_v7.rar?rlkey=mpn3om9hxrhkwr6c9r3pk62yb&dl=0

Score

10^/10

rhadamanthys zgrat persistence rat stealer

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\TvkSetup.exe	family_zgrat_v1
behavioral1/memory/1304-800-0x0000000000BF0000-0x0000000000C80000-memory.dmp	family_zgrat_v1

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs

Processes:

RegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exe

description	pid	process	target process
PID 2332 created 3124	2332	RegAsm.exe	sihost.exe
PID 4696 created 3124	4696	RegAsm.exe	sihost.exe
PID 2988 created 3124	2988	RegAsm.exe	sihost.exe
PID 744 created 3124	744	RegAsm.exe	sihost.exe
PID 4732 created 3124	4732	RegAsm.exe	sihost.exe
PID 1560 created 3124	1560	RegAsm.exe	sihost.exe
PID 3272 created 3124	3272	RegAsm.exe	sihost.exe
PID 3172 created 3124	3172	RegAsm.exe	sihost.exe
PID 236 created 3124	236	RegAsm.exe	sihost.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Executes dropped EXE 14 IoCs

Processes:

winrar-x64-700.exewinrar-x64-700.exe7zFM.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exe

pid	process
4704	winrar-x64-700.exe
1040	winrar-x64-700.exe
2120	7zFM.exe
1304	TvkSetup.exe
5020	TvkSetup.exe
4224	TvkSetup.exe
2920	TvkSetup.exe
3272	TvkSetup.exe
2448	TvkSetup.exe
1916	TvkSetup.exe
4920	TvkSetup.exe
4972	TvkSetup.exe
696	TvkSetup.exe
200	TvkSetup.exe

Loads dropped DLL 2 IoCs

Processes:

7zFM.exe

pid process

3408
2120 7zFM.exe

pid	process
3408
2120	7zFM.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Suspicious use of SetThreadContext 11 IoCs

Processes:

TvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exeTvkSetup.exe

description	pid	process	target process
PID 1304 set thread context of 2332	1304	TvkSetup.exe	RegAsm.exe
PID 5020 set thread context of 4696	5020	TvkSetup.exe	RegAsm.exe
PID 4224 set thread context of 2988	4224	TvkSetup.exe	RegAsm.exe
PID 2920 set thread context of 744	2920	TvkSetup.exe	RegAsm.exe
PID 3272 set thread context of 4732	3272	TvkSetup.exe	RegAsm.exe
PID 2448 set thread context of 1560	2448	TvkSetup.exe	RegAsm.exe
PID 1916 set thread context of 3272	1916	TvkSetup.exe	RegAsm.exe
PID 4920 set thread context of 1988	4920	TvkSetup.exe	RegAsm.exe
PID 4972 set thread context of 3172	4972	TvkSetup.exe	RegAsm.exe
PID 696 set thread context of 728	696	TvkSetup.exe	RegAsm.exe
PID 200 set thread context of 236	200	TvkSetup.exe	RegAsm.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	msiexec.exe
File created	C:\Program Files\7-Zip\7z.dll	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\va.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	msiexec.exe
File created	C:\Program Files\7-Zip\7zCon.sfx	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\th.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\it.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\da.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\af.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	msiexec.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exetaskmgr.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	taskmgr.exe
File opened for modification	C:\Windows\Installer\MSI2FC1.tmp	msiexec.exe
File created	C:\Windows\Installer\e592f34.msi	msiexec.exe
File created	C:\Windows\Installer\e592ec7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592ec7.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{23170F69-40C1-2702-2404-000001000000}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 22 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4704	2332	WerFault.exe	RegAsm.exe
2988	2332	WerFault.exe	RegAsm.exe
1688	4696	WerFault.exe	RegAsm.exe
1080	4696	WerFault.exe	RegAsm.exe
4988	2988	WerFault.exe	RegAsm.exe
4076	2988	WerFault.exe	RegAsm.exe
2516	744	WerFault.exe	RegAsm.exe
372	744	WerFault.exe	RegAsm.exe
3320	4732	WerFault.exe	RegAsm.exe
2980	4732	WerFault.exe	RegAsm.exe
728	1560	WerFault.exe	RegAsm.exe
3396	1560	WerFault.exe	RegAsm.exe
2408	3272	WerFault.exe	RegAsm.exe
1972	3272	WerFault.exe	RegAsm.exe
4704	1988	WerFault.exe	RegAsm.exe
3600	1988	WerFault.exe	RegAsm.exe
2196	3172	WerFault.exe	RegAsm.exe
944	3172	WerFault.exe	RegAsm.exe
2900	236	WerFault.exe	RegAsm.exe
1560	236	WerFault.exe	RegAsm.exe
4308	728	WerFault.exe	RegAsm.exe
4704	728	WerFault.exe	RegAsm.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Mfg	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

Processes:

chrome.exesvchost.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133587978886547594"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe

Modifies registry class 43 IoCs

Processes:

msiexec.exeOpenWith.exeOpenWith.exechrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\SourceList\PackageName = "7z2404-x64.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Drive\shellex\DragDropHandlers\7-Zip	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\ProductName = "7-Zip 24.04 (x64 edition)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\DragDropHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420724240000010000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\Version = "402915328"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000\96F071321C0420724240000010000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420724240000010000000\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420724240000010000000\LanguageFiles = "Complete"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\PackageCode = "96F071321C0420724240000020000000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420724240000010000000\Program = "Complete"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000	msiexec.exe

Opens file in notepad (likely ransom note) 2 IoCs
ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXE

pid process

3352 NOTEPAD.EXE
2224 NOTEPAD.EXE

pid	process
3352	NOTEPAD.EXE
2224	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exemsiexec.exechrome.exeRegAsm.exedialer.exeRegAsm.exedialer.exeRegAsm.exedialer.exeRegAsm.exedialer.exeRegAsm.exedialer.exetaskmgr.exe

pid	process
224	chrome.exe
224	chrome.exe
5028	msiexec.exe
5028	msiexec.exe
3276	chrome.exe
3276	chrome.exe
2332	RegAsm.exe
2332	RegAsm.exe
2196	dialer.exe
2196	dialer.exe
2196	dialer.exe
2196	dialer.exe
4696	RegAsm.exe
4696	RegAsm.exe
2972	dialer.exe
2972	dialer.exe
2972	dialer.exe
2972	dialer.exe
2988	RegAsm.exe
2988	RegAsm.exe
4160	dialer.exe
4160	dialer.exe
4160	dialer.exe
4160	dialer.exe
744	RegAsm.exe
744	RegAsm.exe
1300	dialer.exe
1300	dialer.exe
1300	dialer.exe
1300	dialer.exe
4732	RegAsm.exe
4732	RegAsm.exe
3352	dialer.exe
3352	dialer.exe
3352	dialer.exe
3352	dialer.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

7zFM.exeOpenWith.exeOpenWith.exe

pid process

2120 7zFM.exe
4112 OpenWith.exe
4688 OpenWith.exe

pid	process
2120	7zFM.exe
4112	OpenWith.exe
4688	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

chrome.exe

pid	process
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exemsiexec.exe

pid	process
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
4604	msiexec.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe

Suspicious use of SetWindowsHookEx 34 IoCs

Processes:

winrar-x64-700.exewinrar-x64-700.exeOpenWith.exeOpenWith.exe

pid	process
4704	winrar-x64-700.exe
4704	winrar-x64-700.exe
4704	winrar-x64-700.exe
1040	winrar-x64-700.exe
1040	winrar-x64-700.exe
1040	winrar-x64-700.exe
4112	OpenWith.exe
4112	OpenWith.exe
4112	OpenWith.exe
4112	OpenWith.exe
4112	OpenWith.exe
4112	OpenWith.exe
4112	OpenWith.exe
4112	OpenWith.exe
4112	OpenWith.exe
4112	OpenWith.exe
4112	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe
4688	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 224 wrote to memory of 216	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 216	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 60	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 4636	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 4636	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe
PID 224 wrote to memory of 2176	224	chrome.exe	chrome.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:3124

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2196

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2972

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4160

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3352

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
PID:3344

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
PID:2040

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
PID:4224

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
PID:4668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dropbox.com/scl/fi/tphv3iyn6y8j5h1a29r7j/TvkHack_v7.rar?rlkey=mpn3om9hxrhkwr6c9r3pk62yb&dl=0
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffaa09f9758,0x7ffaa09f9768,0x7ffaa09f9778
2⤵
PID:216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:2
2⤵
PID:60

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:4636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:2176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2844 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:4296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2852 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:4596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4424 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:2772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4432 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:4264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:3980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5284 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:3572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3368 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:1188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5364 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:2932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:3100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5452 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:1412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5580 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:1308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5740 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5892 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:4492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5904 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5556 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:1560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2872 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:5096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4912 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:2532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:3724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4404 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:3120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5792 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:4660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:1412

C:\Users\Admin\Downloads\winrar-x64-700.exe
"C:\Users\Admin\Downloads\winrar-x64-700.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4704

C:\Users\Admin\Downloads\winrar-x64-700.exe
"C:\Users\Admin\Downloads\winrar-x64-700.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=2032 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:3544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=2884 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:2700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5320 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:2540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6136 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:3876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=3620 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5468 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:1
2⤵
PID:8

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:3352

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2404-x64.msi"
2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:4604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:8
2⤵
PID:1316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5556 --field-trial-handle=1764,i,3580203358863756963,377042429604349319,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3276

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3428

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\1d86d54a14b440fbb624f14996b135ca /t 4844 /p 4704
1⤵
PID:3000

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5028

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:2972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2248

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\TvkHack_v7.rar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4112

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Source.cpp
2⤵
- Opens file in notepad (likely ransom note)
PID:3352

C:\Users\Admin\Desktop\TvkSetup.exe
"C:\Users\Admin\Desktop\TvkSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1304

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:372

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 596
3⤵
- Program crash
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 572
3⤵
- Program crash
PID:2988

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\f420a343151544b6a35801b906354498 /t 4388 /p 1040
1⤵
PID:4528

C:\Users\Admin\Desktop\TvkSetup.exe
"C:\Users\Admin\Desktop\TvkSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 608
3⤵
- Program crash
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 616
3⤵
- Program crash
PID:1080

C:\Users\Admin\Desktop\TvkSetup.exe
"C:\Users\Admin\Desktop\TvkSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4224

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 608
3⤵
- Program crash
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 572
3⤵
- Program crash
PID:4076

C:\Users\Admin\Desktop\TvkSetup.exe
"C:\Users\Admin\Desktop\TvkSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 608
3⤵
- Program crash
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 616
3⤵
- Program crash
PID:372

C:\Users\Admin\Desktop\TvkSetup.exe
"C:\Users\Admin\Desktop\TvkSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 596
3⤵
- Program crash
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 616
3⤵
- Program crash
PID:2980

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:4212

C:\Users\Admin\Desktop\TvkSetup.exe
"C:\Users\Admin\Desktop\TvkSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2448

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 636
3⤵
- Program crash
PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 604
3⤵
- Program crash
PID:3396

C:\Users\Admin\Desktop\TvkSetup.exe
"C:\Users\Admin\Desktop\TvkSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1916

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 620
3⤵
- Program crash
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 588
3⤵
- Program crash
PID:1972

C:\Users\Admin\Desktop\TvkSetup.exe
"C:\Users\Admin\Desktop\TvkSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 584
3⤵
- Program crash
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 604
3⤵
- Program crash
PID:3600

C:\Users\Admin\Desktop\TvkSetup.exe
"C:\Users\Admin\Desktop\TvkSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 608
3⤵
- Program crash
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 616
3⤵
- Program crash
PID:944

C:\Users\Admin\Desktop\TvkSetup.exe
"C:\Users\Admin\Desktop\TvkSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 584
3⤵
- Program crash
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 592
3⤵
- Program crash
PID:4704

C:\Users\Admin\Desktop\TvkSetup.exe
"C:\Users\Admin\Desktop\TvkSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:200

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 236 -s 608
3⤵
- Program crash
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 236 -s 628
3⤵
- Program crash
PID:1560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4688

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Source.cpp
2⤵
- Opens file in notepad (likely ransom note)
PID:2224

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e592ec8.rbs
Filesize
30KB

MD5
d56e4a0cde214a42926652ecb1faaeb1

SHA1
97d457e793da40f1c5afe20ed9f9f12753a0c7f4

SHA256
ab7d6337d47bc77c7645fa61346c92a2a47cbe83fdc110264758289793cb5e49

SHA512
041117249e4c961f5f04a886d8369ade99bad55030a636f7d39166bb4a68e166660741f567c95bfbf462df1182dccbc28c5487b7f5efed009e968249c67964b3

Download Submit
C:\Program Files\7-Zip\7zFM.exe
Filesize
960KB

MD5
246da2a8b76013599e3d11b9f6f03515

SHA1
6a10aa64297e68fb5bb5abb940338d5a51c0e81c

SHA256
996e8436a50a1818b574a7ecb078d4f3566d6666fc4defb2493ec7f0c08538a8

SHA512
df9d86b41bca8e90ae212267b3cdac24e5c506dec0d88832b3a7f407f7f9057f23bb5c341137727f593088eb33a811eaddc445ecf1bd61b89cb1777837b0f1f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
7bb31fd712e5125e450a2a2fb9725f51

SHA1
02855c199e17469f48febe697a4c9a6bed1d3117

SHA256
517e0e179ec35a3ae9886b8d6698f78157ce44b197d35c9b8309449989ea6ff7

SHA512
6e7cf3beac7d8f7978b120946c62fe0585b2d068e75e08b5696e067cfd832bf1076c2117947be0d91317fd93b4dd6bdf7459c75810ed83bc515ff7c3d5678a63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
f089ff88ab60e3cb6203add621e7a8a2

SHA1
d988d274cb916df8eb665ae0caaf16505cec56fc

SHA256
af072d7338c4ffe9f27eba262bc5f5b1d375cdfe54534e208480aad7ab042123

SHA512
b7200ee2087d4ebf3aea59544004419ade1059ba3a0bdfbfc9d615c14f0eca9d3b15d9694fe4f6b5d42cd877b0f8d5ebff81c2cdbafa1d6b2c48755549660072

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
fc62da916dd47e933790c1619f21deb5

SHA1
f3111f13b0546aa8d2e02e5f4415261ccdc29e66

SHA256
90ad481fd800929dd92008793e1e7bc87804993014a3410563eb4ef81b1aef3e

SHA512
d45a01ae1ed74aa80ed0e8350310512f01b14f4fa52dd231095906454a8be5d17f8ebb98f51cebaeb498f2c803a05507cf3d849c234b47f8f9dbb9b254ab08fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
42a5de6bd84bea769ed7ceaafbc5b170

SHA1
61a9b97263b71c2208453ef378e9da7efbfce2d2

SHA256
aaa53efa0bfecd6c0004699d1f356ddca823a42b2d262c210473ae18202f84f4

SHA512
4e382e1bc8fe3f04de47cad05ce3dad54d74b639a59354f876eeafefad45b7e69f4afa90f637c6f58374acde4c70b04aa45cd0f566449eba26213df9f426b8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
5accdb89eaac1e3f9c0bd902ead05e66

SHA1
0e9a1cf593b869cf98a27402d9d5a27130d927c5

SHA256
e522e8b06e1521535dfa35ef37f27f90cca9df654c6a98150d039e12b824017e

SHA512
38532e75358665054599525db2552fa11419db48edb8ab62c385b5e4dd9b150c7149c03989af5ccb9bcc7ea9baac9e2f908e73a08aae76db6353018a21d502d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
9fcbf8775e6f06fcb531267ee750b758

SHA1
557e0df5ee2b74fa58b1b2860929c3ad812bf38d

SHA256
5b5e6d45b63b0abad768abfc36d763be50e3e68bc955dfda51b42e1eef320cc2

SHA512
d43332d0ba96ab6d2c526ad1e09a0c6f9adeddc14487ef82047fa82c05c70fcb75d10dd156edf9784c38432033bb3432f81b0ab12154220814f7664b24f07df9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
5d2392cd8374ec16ecdb62b9fb548457

SHA1
1d85b4a5f11414da783585a727be61258558b4aa

SHA256
8a7660350b72ba58a6f16ac71d032c3f14985d754ffb9643382bb1ccf4ae357a

SHA512
60ad173934924a5d7a3097060ca5209a284aec1c20a3b180cfef4e5cbed1c1297238823369a7bdb9f617f23076892e297a2e0288eef88a954d3b4ac7245d9711

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
dd63513ba79d4894a674d8e78165f622

SHA1
83ec24a88f27358c349f5457a7a17ea8a2a5f524

SHA256
9edb153f978ec38cd7e48e28ce448f49f2b7694bc49283661073845884aab974

SHA512
34b89c14e622e2934de341cfd7200c9e9c0f572355996277d95712203edbc26609f7f40fbffd551ffac777065634affdcbcd8a6583908bf31bc0e46f85e684e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
740707ea8c059eaf63b8806a9230a09d

SHA1
ba7b4b22a9065a2031722fbd9f83d183560c5779

SHA256
fc63c83d3dbd20050fddedd445c925902cb2a4c986b9831455532fd1c8c586a5

SHA512
8c1c1709758c94c332f16bd84471953d7fa7939d6107aa8b0f19e0f2549d5c9771c8f7ca0d462be40e029a30c51e4c20a1eeec1d3133bb5785f2eab4194acffc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
b440e1341c1b84cc93301f367dcf8e61

SHA1
50ada95d0146846c2a79e3000afc2b78b6c1f797

SHA256
709c3af8105e41294aa3728f50a8379a7167fb8a919670f9998b60a686eb6b20

SHA512
a7742855fada598f33ebb30232682d999cb7aba484e66be4a2f62f2d28858c65cde301887e062492d6c1325cee7d4e42464d437a004c24d24ca52ef5bc97f21f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
5ce761011654e9f4934ab0ee39f6dc36

SHA1
3b800f7246bdeebc715112242cf6e3ba53075ba5

SHA256
02c08a0861fe93d70187d304e9317dac050112b58b5c511d53c90867f5584d82

SHA512
ff26ad75817f0f6d337bc5818283665f44e90bc778bd5adf825ddb815418b5ab8092e45e80cd5ebefdd85f8c6af47c50a57394832295b65e9bdfe65ff58e72d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
ea8bf3731b85be249a66c95d6cc68dc5

SHA1
b0e7c97ebfa82235d4a94f496a504f5e42cab0ef

SHA256
aa654a284ae687d4107eb626d681fa3b77d7fc79c59a2d180245a550c26e2f08

SHA512
14c0c10f04fd6ca2120ae601b069af1996b505667a2c015e668c88fd7a783d00eaa4147721f11c1f633a9efa446e5155cb1918c67770ddba491bc7ee174814e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
3f4e48ae66f76912bdbd403a723ac92a

SHA1
b75be024354e33b3ad85aa7623ab3b21990ea0be

SHA256
02093b63cecab1239c640b6dd031ac5e769e5c074f0443212e7f631f14d315e8

SHA512
e102d80eeb448447a6577f22edfe9b50abe86c1a6066640fb15024f6f3727a180bec359fb868d92fd214fa30fcb93048efff0091e1b9ff1f7d1abb60d23dea8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
873B

MD5
b273ee92fcae59c253c80b59c3970330

SHA1
85eae286ff6e94595bb83c9c360de5aec722a388

SHA256
4c70103f6328974a615a6ee2a342efe299ac8ae12968e28f363528700f7ec850

SHA512
6de4248d09a8afe1c2d5a53531e59e210e72e387780efe1a0c656a7cf83822434440f8250f9f1cb889d50c2bed780a896b23152b9ea1ef2ec49b1f3324a1b7d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
0e670bb5b218f388fd1d8164f1da95cb

SHA1
bade5e278c6a5473d03a35a238dd0d3a4ed82eaf

SHA256
3c3b79bf0ce3d4773ac55b699e317178bdba29bc740960c229523e968985e1bf

SHA512
dc8e4e80a6fe6a17d96fad6b02b1dec53733cc08e6993908707e82d0c2c20c3ae3441065e945b957732265c261d7ad0323265bab87bc53a0b480765f340b0d5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
501be69b57159ba2e15c3b202bf6f467

SHA1
15f9d948082946dbe5888d3902043a860ddc91e9

SHA256
a9f08c50f0f2e05db17d6aa90b807c2c148939240de88e27ce6cf45adca35456

SHA512
6a2bb51da478d2490c0c7ab74b6d5ba7cf4acfee9f8512366442e70b608c491d897e03b819e7f01debd234838360320a57be924df5907afcb8481bd391b7e78e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
36cc801aecbd682d60b70e43551f18a5

SHA1
3c1b9520e41815a4041eb0ab836b2b0770557cc5

SHA256
5465adf1bcc19a57b93df6b67ef3a0cafc015c5681e8574bdfee4e1f2d07d0c3

SHA512
9c5a4588f2ed14eec3e0d3646fa3be665aa889c68368043096e6bd9a95cb5da6fcd7e78f803ece6b9414e246f61c44dd46e7f937a695bbd25b93ec83ccb05957

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
22a3f6d7c1a357347c1f776a85ae9444

SHA1
2a99c1a9b2dac4b7030cc7bf18dce47517809529

SHA256
79d0f70d20816517c60123c8e8f55ac168295bf09d92d13947e02674c28c0415

SHA512
67c592193a956b8a47b7be9b0aa970d7658c3183dd561deec5bde25aa528e5fc4097b74f24b097e9374deab9c9335b18d1914f2edbaf79c40605a5c60b0aaa63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
ed3dd9e9362073b0758a77bf5a9f3f73

SHA1
7ade57421312bd76ff1bd74393d6b2bc1d91699a

SHA256
78f6baa71df1ed00f6fc4353c59e99eb17831ffab12369b3d2a7b3fd99f6ab21

SHA512
d661b59406de5e2956e672046607b61e66324ea18495b4e6f48dbffe787c7d51f4db14a0bd4378637717f30cc440f4f475f990f2aa34f18358bf0c3cd8f0fe2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
d936be99e1acf51010314121c9c22a8d

SHA1
ee256c75a0f48c5eafb3607058454de12ecc550c

SHA256
789547a33ccd279b1df2810f5c53abbc3b49b495fbec9577bcb864e4dbaeeecc

SHA512
8d0e8cabeadc2ccb3635fa2c5ec1b613d60beb4c5adb5b090ccc25e6e5f82d0015acb7be5536a97c8b0c7290f20f58263bdaa90d7985c19e07d45f8ac2a9ce0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
3fa7abb82df0243ef28ae03e43a7e999

SHA1
6896925936e55c377c9490ae2f37bfff024a4a3d

SHA256
8f466f4e649b7982031a7fdd51a8469792c1c71adc79b2d3e27bda2764550a73

SHA512
978a24689c76d4808af3c7e758d6aabf4cb01890e12b9f3924074ec80a18193b38a7c22f9f9b6a79329e3cf8f91ca8aa3d80bb1783894bbb9b20515b83603dd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
950d5cfc9e3d62b4b547ecb2bb2b7502

SHA1
ab6212b9949f30606949ff2615e5e0e7fda647c5

SHA256
34bb15e7c212a647f7ce9086c55f3e6b3fca467cb1bf9a18a7567c4d128c1203

SHA512
2ba5179ffdc61a4242bf2f2289484047577ee8f97860c37f0e8a0ee2b1f731fcf55f6b301fbb0844a3bb125c40b907d5523fb200e9f440fc68985279847f17d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
2dec0cde69996cc63dfd8caa8c76cd97

SHA1
b8a6994a99b437a666d1c7cfbb681b8f92d7a720

SHA256
9c389924da390c0ecd4a6656ae5925799985691ba73d7f952f4f4ee2169e91a4

SHA512
9b5a73b0d27820a01e326b77a7d9742dd5b71b255f5bd94c2af52ab88745973eb3f3fc44310cefa7c08e057d94c3b334fb3138e5d314ae2fd16fda03ca840bc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
6d42505edfcd80f5f93531ba7a370d7c

SHA1
0d2ef1cd2868502d32b0651cbd162dd034928d52

SHA256
c1fa61c9ca07eab2351337c203ceaf9d3d01d7aa9650c0e90ee25b1a981920c4

SHA512
71162d9d34c002209cb60cfd82bf3900c19bb808b15d633be0d6fc3727a7d64e64fa8184c746c344bc647834c696baa5a54e7395239124995bb8f08bbd73d0f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
ceebd52201458dc1dfe9821483813a6c

SHA1
d0cd55a1bdb45099b974a44d62a82f9eb11e533a

SHA256
31a81bbbafbd2b22121832124cb32abc4b79a6b850b9bbed4b4e57d455e9f497

SHA512
46fe50b8f2ecbfa00594fa66ffe36da9998590649b5a358a945235df7fc91d312cba401f9601b3213dd03161c80ed4209def9a9fb0f4dc2956d87c34617e9e8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
dee346e37aab37da2eb44aa6d8d14c73

SHA1
3ed384f50692f194dc1b006cc3eed5f2a911bd97

SHA256
afa9720cfb68bda8749f235010102a7d0400ec062f2f86927baf289673691b65

SHA512
6d6f69b6a4467a4740db8caba94c3e7541df620b1e12eb512c06595a02c6d03e25d444baef83ab6f9129cd697eef7f679853816569281d93a39001ef9c355313

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
109KB

MD5
753ac0dc27c1d135a85477fcac5bbd18

SHA1
ca830fd70c978722fa5d4e64469d0dacc3a29f1c

SHA256
92cbcdc0ce37668418cf1b5f42f610f64126947eea4ad807a30590223a119e5b

SHA512
ccc75097de93d3a1c5c610b5efbd4bd4dbafbf29fd6080797155e9f83afd0f7e5af67c44b151aaf304d95fb1a56558b61dced582666a93f21b65e459ac32bc33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
108KB

MD5
b1fe1f07d1d6f932e429d005610e5e46

SHA1
0adab4b9f13632005c475ce52d94a5c4c88cb96c

SHA256
0d6840fbf3fb10f20cce7748a9057eae7245332c6895587a0d550bd69c4c8294

SHA512
20eafc208fdb37de80832d4d3e06a08e399fcc6a5635aedd7c666e5439e736cba15a60edd1138d14236d5076162525e15bdd0c204502217cdd5c873a83c6f7c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580fab.TMP
Filesize
102KB

MD5
2bbe01be40d9ce93783ab0d8e390f2ad

SHA1
e18c8eb15e696df571b2f9b0b58469749c91a755

SHA256
2445b75a45a599cf3e4f23ddbc27bb88badf6c9d39c0b24d102012a47aeb4efb

SHA512
493648db4ea3a923548d0fdfbeb12b927da24dbd757d556946c874c53ae896994d8471166d782f4e827276904e364b48a3ab714ee843ae0b0cdc6dc0022e0732

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TvkSetup.exe.log
Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\Desktop\Source.cpp
Filesize
208B

MD5
21a3269d6ca92574bf8c1df314c7e4b4

SHA1
8c86779e62c17fcfe0787719742a775c35c4a8e7

SHA256
186c2c28f2eb634a8f44b151e35ef226ce539adaa12c7be2fd944cd763026f88

SHA512
30a03eee187ba5fdad4c6976d4984fa5ff7576fdc885781fd8dc560d94b1677eca34607bc08881ebb2b3a1d56fd4eff3ac78ee4a290f075927a2715074a40837

Download Submit
C:\Users\Admin\Desktop\TvkSetup.exe
Filesize
548KB

MD5
b4358668cc9495e268115d4350e8b8c1

SHA1
82706d157ed37956650e8f23d9f359bffb96be92

SHA256
3c5086d5aceb0841424049c8a2033c83eda35e0b3cd4fa07a36b6f63e20f80bb

SHA512
acc3ef8daa6096458615ee6281a1503010a89236cd801356ff7cf6a973ce04f574f30307ea2ab754db3aa5fb4aefa51d52a47c9d8692af2759c0fce94b2a4bd3

Download Submit
C:\Users\Admin\Downloads\TvkHack_v7.rar.crdownload
Filesize
439KB

MD5
471b88f3ca9212e0e0fd98879238ebdf

SHA1
d53ebb2de9ea1ccbd98a36853ebdf1a5574de0da

SHA256
4ec5b1f7a5d39fd88858a3f3ddc9c1ee31168046e6d3fb07ce51b4c939bddef7

SHA512
6aa381bdc969fd5c1be4c89657066b5bb2d9d15f2986e49fdc46e3c8f1ae26f7a41132c7fc4002b01913207abc2d72ff49da7957f48d1fc2195ce89e0700b521

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 59295.crdownload
Filesize
1.9MB

MD5
ba4633cb8d60913b9391969c20178ba5

SHA1
4b4e7cf0594c070b7a21a113495c4b8f3a2caedd

SHA256
6a9088743ae698b6c329576769d131a29ee7abb85ac36972fffaf21d8bf8dbaa

SHA512
8154f22da5354c8c4358610c3d658d3293a2e0a3bfb9762ea0ba333b5d375b33cab14726772cbcdeebc9a55257679f0efb2e9226bbfc9bd6de41ad5f81352229

Download Submit
C:\Users\Admin\Downloads\winrar-x64-700.exe
Filesize
3.8MB

MD5
48deabfacb5c8e88b81c7165ed4e3b0b

SHA1
de3dab0e9258f9ff3c93ab6738818c6ec399e6a4

SHA256
ff309d1430fc97fccaa9cb82ddf3d23ce9afdf62dcf8c69512de40820df15e24

SHA512
d1d30f6267349bb23334f72376fe3384ac14d202bc8e12c16773231f5f4a3f02b76563f05b11d89d5ef6c05d4acaacc79f72f1d617ee6d1b6eddab2b866426af

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
26.0MB

MD5
69131412bf5fcb28a9df9503b88e4837

SHA1
5d5c4f882b559dec0037a8b87fbf651097942c2b

SHA256
4ec714ea06cd1df4f87cc15e4673e67b61e5bce0d47d3e42737db5521e3d592a

SHA512
ea58d406030c07be5597242afea37830c025c4f0d65d7e893b6e4f39e2e9a7d36d9e00e821f3aa44ac046c07dca19251af15df6e02af49cba9869ba21d256b97

Download Submit
\??\Volume{38fc5f00-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cc64df27-bc29-4593-9914-03e874b14708}_OnDiskSnapshotProp
Filesize
5KB

MD5
1827062b8aca0ab328f02a34a6c2e4a3

SHA1
54a0ae2abca3bde83488476da7b9fb9292127e2e

SHA256
06d60bca8ea71fc2f177ce339b9d1a5575838e11673c017305f9d148351714c5

SHA512
03b1ca7e1bd6e363fc106a630cfe2ad8d2579cc099991d5538675ae04a08c75c6c00e0c4cccb3f739b48b3194eaa9953e9ef3a44059886c25d51ea2455f41fc9

Download Submit
\??\pipe\crashpad_224_TELGYWXKLPAFWWJH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files\7-Zip\7-zip.dll
Filesize
99KB

MD5
fe487725998a00de2ecd41b1357ca0bc

SHA1
cffe7d83767b3334533f9525bea67e34dcb2b632

SHA256
e0625e017c02038cf25b60d03f3c46da44b4232bf9c664cf30bcf67af81229b1

SHA512
173191f2678a4e73457ce4a4008c432080e050004fe034f93cf05281be6be670c54e0c37f23b90d4f9f6cce4de82fbff71cec817bf301d4d84405ea238f1c730

Download Submit
\Program Files\7-Zip\7z.dll
Filesize
1.8MB

MD5
29f6d49053de1408586f48681864ca5f

SHA1
1071e887849cb92776f4a6d4cb6d0dd1ec264b65

SHA256
84d2bcf774aba77e938d3f36bfe020e0d49cfb3074ad9de69b5af78054602b7e

SHA512
dcdb5252e660b0d186c8db508db3fdaab22d33bc20dcaca2b41d5d5e64d5780b25f2242389227ddefff96978f373f89942389673c737b3102778982b91ca6f32

Download Submit
memory/744-866-0x0000000003D30000-0x0000000004130000-memory.dmp

Filesize
4.0MB

Download
memory/744-867-0x00007FFAACB60000-0x00007FFAACD3B000-memory.dmp

Filesize
1.9MB

Download
memory/744-869-0x0000000074B50000-0x0000000074D12000-memory.dmp

Filesize
1.8MB

Download
memory/1300-873-0x00007FFAACB60000-0x00007FFAACD3B000-memory.dmp

Filesize
1.9MB

Download
memory/1300-875-0x0000000074B50000-0x0000000074D12000-memory.dmp

Filesize
1.8MB

Download
memory/1300-872-0x0000000004C50000-0x0000000005050000-memory.dmp

Filesize
4.0MB

Download
memory/1304-800-0x0000000000BF0000-0x0000000000C80000-memory.dmp

Filesize
576KB

Download
memory/1560-931-0x0000000003700000-0x0000000003B00000-memory.dmp

Filesize
4.0MB

Download
memory/1560-932-0x00007FFAACB60000-0x00007FFAACD3B000-memory.dmp

Filesize
1.9MB

Download
memory/2196-817-0x0000000074B50000-0x0000000074D12000-memory.dmp

Filesize
1.8MB

Download
memory/2196-815-0x00007FFAACB60000-0x00007FFAACD3B000-memory.dmp

Filesize
1.9MB

Download
memory/2196-812-0x0000000002700000-0x0000000002709000-memory.dmp

Filesize
36KB

Download
memory/2196-814-0x0000000004340000-0x0000000004740000-memory.dmp

Filesize
4.0MB

Download
memory/2332-807-0x00000000035E0000-0x00000000039E0000-memory.dmp

Filesize
4.0MB

Download
memory/2332-808-0x00000000035E0000-0x00000000039E0000-memory.dmp

Filesize
4.0MB

Download
memory/2332-809-0x00007FFAACB60000-0x00007FFAACD3B000-memory.dmp

Filesize
1.9MB

Download
memory/2332-806-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2332-803-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2332-811-0x0000000074B50000-0x0000000074D12000-memory.dmp

Filesize
1.8MB

Download
memory/2972-835-0x0000000074B50000-0x0000000074D12000-memory.dmp

Filesize
1.8MB

Download
memory/2972-833-0x00007FFAACB60000-0x00007FFAACD3B000-memory.dmp

Filesize
1.9MB

Download
memory/2972-832-0x0000000004D80000-0x0000000005180000-memory.dmp

Filesize
4.0MB

Download
memory/2988-843-0x0000000003700000-0x0000000003B00000-memory.dmp

Filesize
4.0MB

Download
memory/2988-847-0x0000000074B50000-0x0000000074D12000-memory.dmp

Filesize
1.8MB

Download
memory/2988-844-0x00007FFAACB60000-0x00007FFAACD3B000-memory.dmp

Filesize
1.9MB

Download
memory/3352-883-0x00000000040F0000-0x00000000044F0000-memory.dmp

Filesize
4.0MB

Download
memory/3352-886-0x0000000074B50000-0x0000000074D12000-memory.dmp

Filesize
1.8MB

Download
memory/3352-884-0x00007FFAACB60000-0x00007FFAACD3B000-memory.dmp

Filesize
1.9MB

Download
memory/4160-853-0x0000000074B50000-0x0000000074D12000-memory.dmp

Filesize
1.8MB

Download
memory/4160-850-0x0000000004760000-0x0000000004B60000-memory.dmp

Filesize
4.0MB

Download
memory/4160-851-0x00007FFAACB60000-0x00007FFAACD3B000-memory.dmp

Filesize
1.9MB

Download
memory/4696-829-0x0000000074B50000-0x0000000074D12000-memory.dmp

Filesize
1.8MB

Download
memory/4696-827-0x00007FFAACB60000-0x00007FFAACD3B000-memory.dmp

Filesize
1.9MB

Download
memory/4696-826-0x00000000036D0000-0x0000000003AD0000-memory.dmp

Filesize
4.0MB

Download
memory/4732-877-0x0000000003BC0000-0x0000000003FC0000-memory.dmp

Filesize
4.0MB

Download
memory/4732-880-0x0000000074B50000-0x0000000074D12000-memory.dmp

Filesize
1.8MB

Download
memory/4732-878-0x00007FFAACB60000-0x00007FFAACD3B000-memory.dmp

Filesize
1.9MB

Download