Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-05-2024 14:37
Static task
static1
URLScan task
urlscan1
General
Malware Config
Extracted
orcus
209.25.141.181:40489
248d60d8a7114264bce951ca45664b1d
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programdata%\Chrome\chromedriver.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
winlogon.exe
-
watchdog_path
AppData\svchost.exe
Signatures
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe family_orcus -
Orcurs Rat Executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe orcus behavioral1/memory/4544-1878-0x0000000000850000-0x000000000094C000-memory.dmp orcus -
Executes dropped EXE 12 IoCs
Processes:
7z2301-x64.exe7zFM.exeBlitzedGrabberV12.exemxfix.EXEUnityCrashHandlerV2.exeBlitzedGrabberV12.exeWindowsInput.exeWindowsInput.exechromedriver.exesvchost.exesvchost.exechromedriver.exepid process 1488 7z2301-x64.exe 5008 7zFM.exe 2756 BlitzedGrabberV12.exe 3816 mxfix.EXE 2120 UnityCrashHandlerV2.exe 1824 BlitzedGrabberV12.exe 1012 WindowsInput.exe 4988 WindowsInput.exe 4544 chromedriver.exe 2396 svchost.exe 5992 svchost.exe 3840 chromedriver.exe -
Loads dropped DLL 4 IoCs
Processes:
7zFM.exeBlitzedGrabberV12.exepid process 3344 3344 5008 7zFM.exe 1824 BlitzedGrabberV12.exe -
Obfuscated with Agile.Net obfuscator 33 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1824-451-0x0000000005350000-0x0000000005542000-memory.dmp agile_net behavioral1/memory/1824-468-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-489-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-493-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-505-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-523-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-521-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-519-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-517-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-515-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-513-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-511-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-509-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-507-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-499-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-495-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-491-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-487-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-486-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-503-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-501-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-497-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-483-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-481-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-479-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-477-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-471-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-475-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-473-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-466-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-464-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-461-0x0000000005350000-0x000000000553E000-memory.dmp agile_net behavioral1/memory/1824-462-0x0000000005350000-0x000000000553E000-memory.dmp agile_net -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
7z2301-x64.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2301-x64.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
mxfix.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" mxfix.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
UnityCrashHandlerV2.exedescription ioc process File created C:\Windows\assembly\Desktop.ini UnityCrashHandlerV2.exe File opened for modification C:\Windows\assembly\Desktop.ini UnityCrashHandlerV2.exe -
Drops file in System32 directory 5 IoCs
Processes:
UnityCrashHandlerV2.exeWindowsInput.exechrome.exedescription ioc process File created C:\Windows\SysWOW64\WindowsInput.exe UnityCrashHandlerV2.exe File created C:\Windows\SysWOW64\WindowsInput.exe.config UnityCrashHandlerV2.exe File created C:\Windows\SysWOW64\WindowsInput.InstallState WindowsInput.exe File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF chrome.exe File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF chrome.exe -
Drops file in Program Files directory 64 IoCs
Processes:
7z2301-x64.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\readme.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\descript.ion 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\History.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 7z2301-x64.exe -
Drops file in Windows directory 4 IoCs
Processes:
chrome.exeUnityCrashHandlerV2.exedescription ioc process File opened for modification C:\Windows\SystemTemp chrome.exe File opened for modification C:\Windows\assembly UnityCrashHandlerV2.exe File created C:\Windows\assembly\Desktop.ini UnityCrashHandlerV2.exe File opened for modification C:\Windows\assembly\Desktop.ini UnityCrashHandlerV2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133593934777599254" chrome.exe -
Modifies registry class 64 IoCs
Processes:
OpenWith.exe7z2301-x64.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip 7z2301-x64.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 8c0031000000000093582153110050524f4752417e310000740009000400efbec5525961a558bb742e0000003f0000000000010000000000000000004a00000000008a621e01500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "3" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\NodeSlot = "4" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Applications OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Applications\7zFM.exe\shell\open OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2301-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Applications\7zFM.exe\shell\open\command OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2301-x64.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Applications\7zFM.exe OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\"" OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip 7z2301-x64.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe -
NTFS ADS 2 IoCs
Processes:
chrome.exechrome.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\BlitzedGrabberV12.rar:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\7z2301-x64.exe:Zone.Identifier chrome.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2776 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exepowershell.exesvchost.exechromedriver.exepid process 4504 chrome.exe 4504 chrome.exe 4040 powershell.exe 4040 powershell.exe 4040 powershell.exe 5992 svchost.exe 5992 svchost.exe 5992 svchost.exe 5992 svchost.exe 4544 chromedriver.exe 4544 chromedriver.exe 4544 chromedriver.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 4544 chromedriver.exe 5992 svchost.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 4544 chromedriver.exe 5992 svchost.exe 5992 svchost.exe 4544 chromedriver.exe 4544 chromedriver.exe 5992 svchost.exe 5992 svchost.exe 4544 chromedriver.exe 4544 chromedriver.exe 5992 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
Processes:
OpenWith.exe7zFM.exechromedriver.exepid process 2348 OpenWith.exe 5008 7zFM.exe 4544 chromedriver.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe Token: SeShutdownPrivilege 4504 chrome.exe Token: SeCreatePagefilePrivilege 4504 chrome.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
Processes:
chrome.exe7zFM.exepid process 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 5008 7zFM.exe 5008 7zFM.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe 4504 chrome.exe -
Suspicious use of SetWindowsHookEx 18 IoCs
Processes:
7z2301-x64.exeOpenWith.exechromedriver.exeBlitzedGrabberV12.exepid process 1488 7z2301-x64.exe 2348 OpenWith.exe 2348 OpenWith.exe 2348 OpenWith.exe 2348 OpenWith.exe 2348 OpenWith.exe 2348 OpenWith.exe 2348 OpenWith.exe 2348 OpenWith.exe 2348 OpenWith.exe 2348 OpenWith.exe 2348 OpenWith.exe 2348 OpenWith.exe 2348 OpenWith.exe 2348 OpenWith.exe 4544 chromedriver.exe 1824 BlitzedGrabberV12.exe 1824 BlitzedGrabberV12.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4504 wrote to memory of 4524 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4524 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 4344 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 228 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 228 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe PID 4504 wrote to memory of 2488 4504 chrome.exe chrome.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/BlitzedOfficial/BlitzedGrabberV12/releases/download/BlitzedGrabberV12/BlitzedGrabberV12.rar1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb27e0cc40,0x7ffb27e0cc4c,0x7ffb27e0cc582⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1808 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2036,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2100 /prefetch:32⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2172,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2396 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3120 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3148 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4252,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4324 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4564,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4596 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4764 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4852,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4856 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4896,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4964 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4848,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4332 /prefetch:82⤵
- NTFS ADS
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5192,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5228 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4280,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4468 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5528,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5532 /prefetch:82⤵
- NTFS ADS
-
C:\Users\Admin\Downloads\7z2301-x64.exe"C:\Users\Admin\Downloads\7z2301-x64.exe"2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4776,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4752 /prefetch:82⤵
- Drops file in System32 directory
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\BlitzedGrabberV12.rar"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\BlitzedGrabberV12\BlitzedGrabberV12.exe"C:\Users\Admin\Desktop\BlitzedGrabberV12\BlitzedGrabberV12.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File mxfixer.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ddocdjxj.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B68.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6B67.tmp"4⤵
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install3⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\ProgramData\Chrome\chromedriver.exe"C:\ProgramData\Chrome\chromedriver.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /launchSelfAndExit "C:\ProgramData\Chrome\chromedriver.exe" 4544 /protectFile4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /watchProcess "C:\ProgramData\Chrome\chromedriver.exe" 4544 "/protectFile"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\BlitzedGrabberV12\README.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
-
C:\ProgramData\Chrome\chromedriver.exeC:\ProgramData\Chrome\chromedriver.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7-zip.dllFilesize
99KB
MD5956d826f03d88c0b5482002bb7a83412
SHA1560658185c225d1bd274b6a18372fd7de5f336af
SHA256f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d
SHA5126503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647
-
C:\Program Files\7-Zip\7z.dllFilesize
1.8MB
MD54e35a902ca8ed1c3d4551b1a470c4655
SHA1ad9a9b5dbe810a6d7ea2c8430c32417d87c5930c
SHA25677222e81cb7004e8c3e077aada02b555a3d38fb05b50c64afd36ca230a8fd5b9
SHA512c7966f892c1f81fbe6a2197bd229904d398a299c53c24586ca77f7f657529323e5a7260ed32da9701fce9989b0b9a2463cd45c5a5d77e56a1ea670e02e575a30
-
C:\Program Files\7-Zip\7z.exeFilesize
544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
C:\Program Files\7-Zip\7zFM.exeFilesize
930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
C:\Program Files\7-Zip\7zG.exeFilesize
684KB
MD550f289df0c19484e970849aac4e6f977
SHA13dc77c8830836ab844975eb002149b66da2e10be
SHA256b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305
SHA512877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38
-
C:\Program Files\7-Zip\Uninstall.exeFilesize
14KB
MD5ad782ffac62e14e2269bf1379bccbaae
SHA19539773b550e902a35764574a2be2d05bc0d8afc
SHA2561c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8
SHA512a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2
-
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idxFilesize
64KB
MD5b5ad5caaaee00cb8cf445427975ae66c
SHA1dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA51292f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f
-
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lockFilesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.valFilesize
1008B
MD5d222b77a61527f2c177b0869e7babc24
SHA13f23acb984307a4aeba41ebbb70439c97ad1f268
SHA25680dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsStateFilesize
649B
MD5282002154c658fa9b89deb7c33460461
SHA15cf78a5614ab4f75ba292845f132241d0ca6ebca
SHA256ec8189895329185cc5ce558f55c2739df7234d33911a05f2fa63074a49cdc0eb
SHA512dcf3c9e00f4dd1d97530ae930eb811288e746d72392359e2f0a80709ba8845080191831e04ed537466db6e0c229b831d3f3cec51a0fe2f78b46fb4fecaced29f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7a2193f8-955b-4bd6-bb09-03beb623232a.tmpFilesize
521B
MD5297a263eacfb6d0c3ac2882df98c45e5
SHA1bb111358dba2918b2ead32480e702edb1b27f61b
SHA2567a4246bfb366075524ac251c088ec2b804efeea993fd4bf432e6d7a01ed7cbdc
SHA51200d6a13fae01ffacd4a245ec9b0d6d3c9c4d38f65decffb171d70155f3a28d02ae5d6dcc5fbb6b3d9839ce2e2de883bc86156abcc5ea70988bce4517b565a753
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5a202eba34a9620b12086cdd7602da0a2
SHA126cfb9720b350ff93969509697146eb050dff93e
SHA256da70194f45a32900d9a7841c0311d7b4b4fb038a53f00dadf11bce01359d0cd4
SHA51250ecc8d7261ea004ad07675bda35f7e26b86f6b7fbabb00506535de83c0c8eb4cd55fe98962a258655f13edec23d5b88ceaa25526133cd490b72ef6f712ef0f0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
521B
MD522df042d235fc9a8d6d00aac54772297
SHA1ba23bfb4fef7ad12a9a4a42ec4ea5de0323d876b
SHA256b6bf1ea5d4e34a9a7e601f9cb6861cc0280fb8fb4a7cc4111381c77b0d4a25be
SHA5126a6b96b0fc9cdc9e5f4ee75d3514764b25081295557572c2f0f99f11e1cb0c4195914af1061f6698663c9d67d3cfd948f8f918bf75b207dbf78048a9745f08e0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5cc6a180b2825ae983bc8a9da7bda07fe
SHA14558baff0c6435928457ebc9b5349d300c7895b1
SHA25624b418454af859f4252ea19f0e324c7f1fa095131bbfd254d66200e95666ce58
SHA5124e13a0b6d8aaada7426cfbc1a2d91e893d220973ab19e46121791e987ae7a0d4d4a50d3436e04ef8b4168c47c0e32bf7818f094acb247911e501b12e935acb4a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5170a5bbb2cad41456484d1ae81734c38
SHA1f8149cc33825ea8658d438cc3fa4a4648d6ef5c3
SHA256caae01f855de6e45f1d50f84c51c361c48f52386d3d4a362370b5275be552210
SHA51234663b9aa186a1dd14e776696b91ff1802e6b2ad38bf21ad09c6664a30e12bb71fbd3c3fdd7c24aeb0163c9028d907d4e909dd445d06274a9d89c6010a9f7cd9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5b3feb0bdbdc1c1091af8a44e39f5fa07
SHA132efe9c7939e604919d2c6cd959d3609f4f8551a
SHA25639f593242675a27c642886c2cac89ddd34cf39061add389342609fe568d16043
SHA512e1ac1cd0517986e96972f17aa233fd7aab951bdd8232a337cba0e76a254ccea13939e0665191d0f0c4e8cbbda26ba9f899539854dbc02cb6581b3eb1b90b0373
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5b57f75507b07d6b591a8c97ef05f6b60
SHA12ba0581d24b5140fc99b057ccc8ab5e20f6b9d5b
SHA25656fe9b524d6e47739670b076eac8f907743924f2754d7a1bd7fd6605cda321fa
SHA512a17c81f36c0b46cba54497c52b54ccae4159a248171694a06e4e2013a1ec3aab1ebce4d1c1ce1d4d79f35cc649b261960dac00ea02cc530017fb12a08ecef035
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD52c0aaa11b43195711f1c4572d686d5f5
SHA108b664a0f19d8541ee98fe2ef625e9a282ffc1da
SHA256a3ccf25d268948aa4ec81899709ed72abd7f6955a31064d24d20fde526f7c92e
SHA512e659da044471028e2ad9f33a021733216a72749dea16955faeb920c40797553ede4b2ef4bdb330334b5dfce3f7982d420e5bc89297435980cb54c6a4b6786c76
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD58125deff0872ba9028d7b63ab51732d9
SHA1db51ad6424cf74f3920671d7dbd8cca777123d9d
SHA256cff93fa142d0b32781b7b187b21444f9c13bc0a78b669bfb6f3a0e8413ac7a1b
SHA512860b55ad7f9e26280ce9130450689b7a94a30165cf4a49106deb63ec1a009855a2b26db082e2c3cf07d13b7dbc72483b557991a33b560ba118a8c91f461eaba9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5a260fbabbd0452d5acfa32a7bf0e21b1
SHA1d667398058d254b2adb3026ff4cd80625bae5bdf
SHA256c97b66ef06b30aa265db4061253149884f3f2cdd63dc4c589491b8d97471fb25
SHA512b6b3b47052f3876cda4c48903da2f0e94443978a6ce57ec8cc7df0b14bd9d9f5bf9ada6f182e5f6be35e35170b791411855c22bf4a6131be525dd9f997b6039f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5f89d59cd16d9071714bfd9bb005ab7ca
SHA187fd0a36d76301deace0f3a3a5e5c57d3ceffd22
SHA256434946f0cb1ad1d9f24e351b5085ce31960c22a410ac5e1cce39c626f26e7f80
SHA5127c4f7b58c9fe03ce9cba3a3d0f153a28c4644550c6ba813d05dbd6b2b79c85b877bf4b33d58c651851dcd07b43cfb73a7fee6f96dd296f6fe0022078dd21ff71
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD59944b6a5c9a525b6c2a294330f45b5a0
SHA124c22ea7adc7585db46ee9ae578b1aadaa146e0e
SHA25620aa221dd52763045755d775558214b8b5cd8644ecc99ca9a9746e654f901ef2
SHA5128b8be50212cab9fe1c754ba1dbae9d75f8274638c9d8466fc5d270fbe262786e77297825ea8110c608034c20e31187a32dbd93d598ee82f5eb6ea9994989e2ee
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD56425e4446cfd59ff8b2e05290b2eaba5
SHA1d33a27244ef19487756c51c6936e82dde45d27ed
SHA256978bfb75cf67615ea18354ed2a3159e8494f27467f803043bee33010ec7be903
SHA512f30ede66c9b32dd56f8ebb52fb0adfa8542f5c57d889036120668bd1ead0f198dca004ddfe162408e96273bdd530d1afbaf376395e77e27c18f313aaa6c8565a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
77KB
MD5469954a04d73ef917aa829cb5e150159
SHA1f41ab1489f6936f307f8a1666e03c7ae642927cf
SHA25688f27ca4045f7cbcb42bb70ba4c058a19b363527ceae944589fcfd059019229a
SHA5122db0ee202c0c6782efdb76a52e4175f48d153dbab1b3817f99424b58d63eab71a79bcd59a58a4209392b91d6f86b00c24feefb6944aaf5fce7aadf6aded4d569
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
77KB
MD504b75de952e9635afaad40ab244b648b
SHA11df0690529a6f334e0cf2393bcfe11ff6ee042c6
SHA256396756d3923913aeecaed868981f6b8c91a8f9dcbd41e4808c74521c4a27ce1b
SHA512f4759a061e8c34d55bd3ff0de3a3569146a63750729d57150a94802750898bed2f3d1690e4c2cbca879a3250975f71181969acb03c4e261c3f2cb8ead4bf49aa
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.logFilesize
425B
MD5bb27934be8860266d478c13f2d65f45e
SHA1a69a0e171864dcac9ade1b04fc0313e6b4024ccb
SHA25685ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4
SHA51287dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exeFilesize
1.6MB
MD5228a69dc15032fd0fb7100ff8561185e
SHA1f8dbc89fed8078da7f306cb78b92ce04a0bdeb00
SHA256920bec9d500f6446b84399ab4c84858d0f0d7d1abb2e0377399ebbc4bafad709
SHA512373621c4743fa72571b3c8375aa6f7852303a821558b016b002d2af07154787d978f66696db89eeed8fe41f4aed5d66b690d4f87469939f9b1dea2ac2b9101f1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mxfixer.ps1Filesize
35B
MD55d792fc7c4e2fd3eb595fce4883dcb2d
SHA1ee2a88f769ad746f119e144bd06832cb55ef1e0f
SHA25641eccaa8649345b33e57f5d494429276e9f2eb23ca981f018da33a34aabfd8eb
SHA5124b85fe8205c705914867227c97aa1333421970d8e6f11b2ac6be8e95fef1a0f31f985547eafe52e382f13c2a16afa05462bd614b75bee250464c50734d59a92e
-
C:\Users\Admin\AppData\Local\Temp\RES6B68.tmpFilesize
1KB
MD5a1126c8487a5b9f20c84b404a9031a91
SHA15bdc33fe398ae18377ac178654585c9a5d8c3140
SHA2561a3003c550ac1e3a769e1e026002fb15c4acb9f801c915d9b647ed9655a19983
SHA512a05461bb140016f7a0993ff3ef30abac1cf80f6a0c47d195e3895cae0723248c9ce98ddfac95c8a50a796b93a4502f86a6056040a1312be8b7171c8d85006b6d
-
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exeFilesize
6.0MB
MD53926c7b8fdfb0ab3b92303760b14d402
SHA1b33e12ef4bdcd418139db59d048609c45fe8f9eb
SHA256c101904ec19b45612213c2b398892a4523f63862bb3e24c245509db2417585e7
SHA5124a022be27f58b1735f3a0ac9abdedbd769adb4e3ca1dacdcdc98700b17e138b647f9059585c8ef37fdd7072ad6283e95f10def171584097eb8c70e7d1212ce0e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jnlbmdq1.wb1.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\dcfb00f9-5ae7-4197-ba59-e48107e40d35\GunaDotNetRT.dllFilesize
136KB
MD59af5eb006bb0bab7f226272d82c896c7
SHA1c2a5bb42a5f08f4dc821be374b700652262308f0
SHA25677dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
SHA5127badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a
-
C:\Users\Admin\AppData\Local\Temp\ddocdjxj.dllFilesize
76KB
MD57938e0f8dac3df60628b7ebaf3d028ca
SHA1d5ebeba3742441fa4e3cf5c127bcad4b9a6e6db3
SHA256226a38e378bcfc5d6e842a319ddd0b8d8e0a04f7e4f97891e7c122385c767455
SHA512322168a638dcfa61bb80e2505dcefa4b980617a9481d1c33f12bd72aa437ad6563021e5f3e8db6b925023d68bf84712fbc95338443613941b84d5c8782e8020b
-
C:\Users\Admin\AppData\Local\Temp\mxfix.EXEFilesize
155KB
MD5b4ec612c441786aa614ce5f32edae475
SHA13a264f8daeec9b156ddb5ed576d490dd8fbd8e7d
SHA256e18ba6573b9aa2d139ed5c30f18ac2ece3ce8287d1651db4bc632dbc816f53bd
SHA512c6800371cdc2b571061e6e755a2c95f49dcb233c3999976f180cb7cf95fa2c62d03b52a3c497a2cd7ae46ec72eaf823db25bd291ca676724194c05966f2bce16
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\Desktop\BlitzedGrabberV12\README.txtFilesize
1KB
MD5110a464be52a150056f184348f09a6c6
SHA1c7516032dbae3d9e3c0342da0bd690318b93be6f
SHA25697b778580fd7487beb8062a777a654b718a3b16622d8bcf46594ac9048dd3e6a
SHA51204c97df944b110f6c481f2b06b406d7ba5b2b3a6176a2527ae8b9820d925a341fd106e20dd3694353effa4f623c8eeb3f858de478ebc13fa6c68d6ab04db85cf
-
C:\Users\Admin\Downloads\BlitzedGrabberV12.rar.crdownloadFilesize
3.6MB
MD54282ce784621bf22365f21260be70e5e
SHA13e743738e2ec8cc35d64ebbad99abcfde46eafe3
SHA25606fa7e3221aa6f67eeefa8b807a6abb0b4c385d7eb61434ccec55ad2a5d3a1dd
SHA512aa776cfdc39c152814a7e0e6def451454ca30fc4388dec48f3d12b1e50a0ee3925bfd2333700919b52af725cfe7ece93146ba24a9c0d2a6c0d602f7b243b77ec
-
C:\Users\Admin\Downloads\BlitzedGrabberV12.rar:Zone.IdentifierFilesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
C:\Users\Admin\Downloads\Unconfirmed 522975.crdownloadFilesize
1.5MB
MD5e5788b13546156281bf0a4b38bdd0901
SHA17df28d340d7084647921cc25a8c2068bb192bdbb
SHA25626cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd
SHA5121f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff
-
C:\Windows\SysWOW64\WindowsInput.exeFilesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
-
C:\Windows\SysWOW64\WindowsInput.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
\??\c:\Users\Admin\AppData\Local\Temp\CSC6B67.tmpFilesize
676B
MD599f6cb770ac33b86b90940a487d2ae18
SHA1d9cf33893d57d3b71d3a685d9fb756f24cdbb9ea
SHA25610125de473a8713a591c9571663276a7bd20d46709c6c8dce7e4ef9b97cdc804
SHA5126e6d8f8cc9546133cf8d9baa62e0ccaee4de9d5d6ec9de24728ae432b7f3b3976848333f72a13ef39642e451a35189ede310e020c23173642ddd82512cc153b5
-
\??\c:\Users\Admin\AppData\Local\Temp\ddocdjxj.0.csFilesize
208KB
MD5e06272bb28419b66481100c1edebcca4
SHA16c4be58c03ce6283ffc55392b679cf11daec3027
SHA256724518389e905eba242aa82d7ad9b1c4034523878d999665c7c9905c5ebf253e
SHA512ac1492fe22c9ef874cff8b12540f909c169b58ac6c14f480fbb320a5d353037653159c6e4099dd09be3d55410fa5f0cef6c87a4ff8f9447322fa18daaf50d425
-
\??\c:\Users\Admin\AppData\Local\Temp\ddocdjxj.cmdlineFilesize
349B
MD5b94596a8f2984f4fb1586696691a2fc8
SHA13d0892b8573aafdca7ffa391774f00bcd64e1a9e
SHA2560aeabb091d630bf32bb7529780f52a38a53a3327c188210d6c4bdb41cb3cf3ee
SHA512943719cc9c9c90be9e4895ba649f3295b090e506b974b0f58d2bd5351a544b37a1fe4a4baccaff5e2142f4458e1e029bd1b82eb40c0e05e4894a770fd2ae88dc
-
\??\pipe\crashpad_4504_OUMUGMHPCRQUQWLFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1012-685-0x000000001BB80000-0x000000001BBBC000-memory.dmpFilesize
240KB
-
memory/1012-684-0x0000000003110000-0x0000000003122000-memory.dmpFilesize
72KB
-
memory/1012-683-0x0000000000EE0000-0x0000000000EEC000-memory.dmpFilesize
48KB
-
memory/1824-481-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-501-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-440-0x0000000000480000-0x000000000062C000-memory.dmpFilesize
1.7MB
-
memory/1824-441-0x0000000005560000-0x0000000005B06000-memory.dmpFilesize
5.6MB
-
memory/1824-521-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-523-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-479-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-513-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-515-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-505-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-445-0x0000000005050000-0x00000000050E2000-memory.dmpFilesize
584KB
-
memory/1824-12213-0x0000000006280000-0x000000000631C000-memory.dmpFilesize
624KB
-
memory/1824-493-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-489-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-470-0x0000000070DA0000-0x0000000070DD7000-memory.dmpFilesize
220KB
-
memory/1824-468-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-511-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-509-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-507-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-499-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-495-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-491-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-487-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-486-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-503-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-477-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-517-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-483-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-497-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-10614-0x0000000070DA0000-0x0000000070DD7000-memory.dmpFilesize
220KB
-
memory/1824-519-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-471-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-475-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-473-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-466-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-464-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-461-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-460-0x0000000073270000-0x00000000732FA000-memory.dmpFilesize
552KB
-
memory/1824-462-0x0000000005350000-0x000000000553E000-memory.dmpFilesize
1.9MB
-
memory/1824-450-0x0000000004FB0000-0x0000000004FBA000-memory.dmpFilesize
40KB
-
memory/1824-451-0x0000000005350000-0x0000000005542000-memory.dmpFilesize
1.9MB
-
memory/2120-446-0x000000001C050000-0x000000001C05E000-memory.dmpFilesize
56KB
-
memory/2120-452-0x000000001CAA0000-0x000000001CB3C000-memory.dmpFilesize
624KB
-
memory/2120-449-0x000000001C530000-0x000000001C9FE000-memory.dmpFilesize
4.8MB
-
memory/2120-665-0x000000001CB70000-0x000000001CB86000-memory.dmpFilesize
88KB
-
memory/2120-669-0x000000001D1A0000-0x000000001D1C0000-memory.dmpFilesize
128KB
-
memory/2120-442-0x000000001BE60000-0x000000001BEBC000-memory.dmpFilesize
368KB
-
memory/2120-668-0x0000000001860000-0x0000000001868000-memory.dmpFilesize
32KB
-
memory/2120-667-0x0000000001880000-0x0000000001892000-memory.dmpFilesize
72KB
-
memory/2396-3290-0x0000000000560000-0x0000000000568000-memory.dmpFilesize
32KB
-
memory/2756-379-0x00000000006A0000-0x00000000008E4000-memory.dmpFilesize
2.3MB
-
memory/4040-426-0x000002861F1C0000-0x000002861F1E2000-memory.dmpFilesize
136KB
-
memory/4544-2269-0x000000001B960000-0x000000001B9AE000-memory.dmpFilesize
312KB
-
memory/4544-2246-0x000000001B450000-0x000000001B462000-memory.dmpFilesize
72KB
-
memory/4544-1878-0x0000000000850000-0x000000000094C000-memory.dmpFilesize
1008KB
-
memory/4544-2638-0x000000001BEE0000-0x000000001C0A2000-memory.dmpFilesize
1.8MB
-
memory/4544-2701-0x000000001BE10000-0x000000001BE20000-memory.dmpFilesize
64KB
-
memory/4544-2515-0x000000001BB30000-0x000000001BB48000-memory.dmpFilesize
96KB
-
memory/4988-690-0x000000001AAE0000-0x000000001ABEA000-memory.dmpFilesize
1.0MB