2d1307efa269e7f18f1818e672c028c76de3cb3c8ec3cd3c2bf9816bddf1a8de

Resubmissions

04/05/2024, 02:39

240504-c5lynsec268

04/05/2024, 02:37

240504-c4at1seb777

04/05/2024, 02:33

240504-c1tsqaea987

Analysis

max time kernel
60s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Styx Client Latest.dll
Size 4.2MB
Sample240504-c1tsqaea98
SHA256 2d1307efa269e7f18f1818e672c028c76de3cb3c8ec3cd3c2bf9816bddf1a8de
MD5 10f9853fa1b839fe3f9234db75745456
SHA1 078b7fffc7763b4e237c5da77be5cde421584e93
SHA512 4a0ff0304867312be0da118f9117c42eb1967b00ddf827a3c7d2f41d6b6aa2a2acfbd85302d60d0b70794663becce7bee0543c770f66ec6cc4b306e35ba9e844
SSDEEP 98304:cR07jKsGPxbGp7blGwOYS9gHm2Pk8zFcdaWlz0cuMWZ:97iWvRS+nudTBuFZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2340	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1412	chrome.exe
1412	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2340	vlc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe
2340	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2340	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2396	1412	chrome.exe	29
PID 1412 wrote to memory of 2396	1412	chrome.exe	29
PID 1412 wrote to memory of 2396	1412	chrome.exe	29
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2608	1412	chrome.exe	31
PID 1412 wrote to memory of 2808	1412	chrome.exe	32
PID 1412 wrote to memory of 2808	1412	chrome.exe	32
PID 1412 wrote to memory of 2808	1412	chrome.exe	32
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33
PID 1412 wrote to memory of 2560	1412	chrome.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Styx Client Latest.dll",#1
1⤵
PID:2360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7089758,0x7fef7089768,0x7fef7089778
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2300 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1484 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:2
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2912 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3560 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3552 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:8
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2776 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2372 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=1380,i,3534229472072812199,1077985941845434497,131072 /prefetch:8
  2⤵
  PID:2120

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2632

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:896

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\DenyClear.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2340

C:\Windows\system32\SndVol.exe
SndVol.exe -f 46400677 17137
1⤵
PID:1520

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe"
1⤵
PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

000007.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000007.dbtmp
Size 16B
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
MD5 SHA1 SHA512

Submit Download

000006.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
Size 16B
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 359B
SHA256 9cf713e6a4361a11366f2b9a45a7889d41b63c5ad6ce5b6923107fefb9731ff8
MD5 fdb771716d950f51bbafe3c386965435
SHA1 25dd1444cc26764339e28649a0c0afd53bf47dbd
SHA512 e37d2b83262c5b1c2294a7d38cce6dcec614c22acf776809aca7102c617865fc9df01c36fa60926fdd76daa8e0759ab4b09804768bc1b08fca6b13f1de85a626
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 361B
SHA256 6954cc258d46632c1d34c78fa3951f1e72e2d0de1139128339ed267bff358c99
MD5 41b4f03b4443edd4e040d0d94d00c9e0
SHA1 56bfce188f41b9455fccde72e81d96fb5396f61a
SHA512 2da75903c514ff1d151f4bca39385d8c28d0d190923146ca5d624ac415e7e4a3c071de15d27e6da5e4f67756e9b0ac1f4b2d1ed685aaa5ffc3398e281f12a343
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 4ebf748864eb25782fd23d26ff16b6c0b04cfcc628795d22f4f9bacc38bfff0a
MD5 ae79f05fed18e32a5f07c28cf12eac15
SHA1 e9719bea80d080c76c341f93b8ea997708f3c12e
SHA512 04e1f6284b01a6957de383f184fc1379348ac1ee7bd61d80e41bc69485e06a78831df1107f8e2bc193c4b99343548b90b58a333a1e11df97b7c771d7d6df711f
SSDEEP 192:Ptcc2kJeaTez8H+yy+FHk51Ji8MzotjEsXtScPS:Ptcceakyx81Ji8MktIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 65b0c27f534a3fe74eedc96161a96cb2c22bf37470ae97c2d7eda537e5f65623
MD5 63193bc2972b98aedbd74ba45b4c54e4
SHA1 800009f769b78c50f35e69d2cf9ba3fa17c7772b
SHA512 8524df41cda7fc19d6a53fbc864604d6c57c73721ef213b65e8af9338f018f1d379d4a525cb122103378a02fbbb638d7dfe5ccea17c706a9ef4dbc7f2f1e0163
SSDEEP 96:PtsyaTKIRSJd8iZRy7Di+6MsmdedyIO1elg8rgzjVhYtjEsXt0/cg2Vup:PtpaTez8syy+FSyGi8MzotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 7dd76a7f13439d8e27807f6dbe37a36253b1b4a166082eac0f7023ea5c33a333
MD5 cb39e5cf17f6bc023677b230889371c1
SHA1 2821fce86e1383612c99346aceef01969e666a81
SHA512 e76a5bf3661deff7c4626d0f29b78b56bbab81772f71b2a1a3a46cbf23cf92a7d24cb5d7c49a4dd9ddbcd45f6396810342ee1040864e8c2edb4b65dacfc0144d
SSDEEP 96:PtsyaTKIRSJd8iZRy7Di+6MsmdedoO1elg8rgzjVhYtjEsXt0/cg2Vup:PtpaTez8syy+FSmi8MzotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFf77a728.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFf77a728.TMP
Size 5KB
SHA256 dd7e6079549bf9e5e3fb9b84c8699e377011a66c008e7ea40bbd87ba565512ac
MD5 626a787e4b0bdae5880cd42e551f4808
SHA1 a75b3876a695cc83435e71d9c98e2295161da620
SHA512 18135973dcc4bac72e1bc4c54fab8d8350d6c079c05e980da1c34c12717474028890ca4c5b3711b9e0c035d26cf84c455bb3b95cef77e26012f6a29d6648f275
SSDEEP 96:PtsyaTKIRSJd8iZRy7Di+6MsmdedhO1elg8rgzjVhYtjEsXt0/cg2Vup:PtpaTez8syy+FSri8MzotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TarB4A6.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarB4A6.tmp
Size 177KB
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 76B
SHA256 f926bd34a364ee6e1a2a8f5dda96b16f07899981cd280d65734c104368bfe268
MD5 dbc08e7286d5ca8531d1bc340d448ac0
SHA1 6b30cda1a7435c17cbbbe0a9f85ea13d85242092
SHA512 9ff630882e719f727f72908094aea5144a5a54c438c0f5eb19d21e1e92647d302d4c41de3690596d8361f29819b0cae2d31074a561fa3c403a290eb077c35e8b
MD5 SHA1 SHA512

Submit Download

memory/776-352-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/776-353-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/2340-121-0x000007FEF2720000-0x000007FEF2738000-memory.dmp

Download

memory/2340-113-0x000007FEF3DD0000-0x000007FEF3E0F000-memory.dmp

Download

memory/2340-131-0x000007FEF24C0000-0x000007FEF24D1000-memory.dmp

Download

memory/2340-130-0x000007FEF24E0000-0x000007FEF2503000-memory.dmp

Download

memory/2340-129-0x000007FEF2510000-0x000007FEF2527000-memory.dmp

Download

memory/2340-128-0x000007FEF2530000-0x000007FEF2554000-memory.dmp

Download

memory/2340-127-0x000007FEF2560000-0x000007FEF2588000-memory.dmp

Download

memory/2340-126-0x000007FEF2590000-0x000007FEF25E6000-memory.dmp

Download

memory/2340-125-0x000007FEF25F0000-0x000007FEF2601000-memory.dmp

Download

memory/2340-124-0x000007FEF2610000-0x000007FEF267F000-memory.dmp

Download

memory/2340-123-0x000007FEF2680000-0x000007FEF26E7000-memory.dmp

Download

memory/2340-112-0x000007FEF2760000-0x000007FEF2960000-memory.dmp

Download

memory/2340-120-0x000007FEF2740000-0x000007FEF2751000-memory.dmp

Download

memory/2340-119-0x000007FEF3D00000-0x000007FEF3D1B000-memory.dmp

Download

memory/2340-118-0x000007FEF3D20000-0x000007FEF3D31000-memory.dmp

Download

memory/2340-116-0x000007FEF3D60000-0x000007FEF3D71000-memory.dmp

Download

memory/2340-117-0x000007FEF3D40000-0x000007FEF3D51000-memory.dmp

Download

memory/2340-114-0x000007FEF3DA0000-0x000007FEF3DC1000-memory.dmp

Download

memory/2340-115-0x000007FEF3D80000-0x000007FEF3D98000-memory.dmp

Download

memory/2340-132-0x000007FEF24A0000-0x000007FEF24B2000-memory.dmp

Download

memory/2340-111-0x000007FEF2960000-0x000007FEF3A0B000-memory.dmp

Download

memory/2340-122-0x000007FEF26F0000-0x000007FEF2720000-memory.dmp

Download

memory/2340-148-0x000007FEF2960000-0x000007FEF3A0B000-memory.dmp

Download

memory/2340-103-0x000007FEF3A10000-0x000007FEF3CC4000-memory.dmp

Download

memory/2340-104-0x000007FEF4AB0000-0x000007FEF4AC8000-memory.dmp

Download

memory/2340-106-0x000007FEF3E90000-0x000007FEF3EA1000-memory.dmp

Download

memory/2340-107-0x000007FEF3E70000-0x000007FEF3E87000-memory.dmp

Download

memory/2340-108-0x000007FEF3E50000-0x000007FEF3E61000-memory.dmp

Download

memory/2340-109-0x000007FEF3E30000-0x000007FEF3E4D000-memory.dmp

Download

memory/2340-110-0x000007FEF3E10000-0x000007FEF3E21000-memory.dmp

Download

memory/2340-105-0x000007FEF4040000-0x000007FEF4057000-memory.dmp

Download

memory/2340-102-0x000007FEF3F40000-0x000007FEF3F74000-memory.dmp

Download

memory/2340-101-0x000000013F680000-0x000000013F778000-memory.dmp

Download

memory/2360-0-0x000007FEF5910000-0x000007FEF65C0000-memory.dmp

Download

memory/2360-1-0x000007FEF4C60000-0x000007FEF5910000-memory.dmp

Download

memory/2360-2-0x000007FEF5910000-0x000007FEF65C0000-memory.dmp

Download

memory/2360-3-0x000007FEF4C60000-0x000007FEF5910000-memory.dmp

Download