hxxps://miniigri[.]net/1223-senya-i-venya-vozdushnaya-katavasiya[.]html

Analysis

max time kernel
1800s
max time network
1795s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://miniigri.net/1223-senya-i-venya-vozdushnaya-katavasiya.html

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
3972	winrar-x64-700.exe
1972	7z2301-x64.exe
3440	Сеня и Веня. Воздушная катавасия.exe
3504	Сеня и Веня. Воздушная катавасия (1).exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2301-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133598151562249907"	chrome.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018855536-2201274732-320770143-1000\{7367B06F-4C1A-43C6-9E5F-B70331256949}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4856	chrome.exe
4856	chrome.exe
2992	chrome.exe
2992	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4340	OpenWith.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
3972	winrar-x64-700.exe
3972	winrar-x64-700.exe
3972	winrar-x64-700.exe
1972	7z2301-x64.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe
3440	Сеня и Веня. Воздушная катавасия.exe
3504	Сеня и Веня. Воздушная катавасия (1).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 3028	4856	chrome.exe	84
PID 4856 wrote to memory of 3028	4856	chrome.exe	84
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 2176	4856	chrome.exe	87
PID 4856 wrote to memory of 4104	4856	chrome.exe	88
PID 4856 wrote to memory of 4104	4856	chrome.exe	88
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89
PID 4856 wrote to memory of 4208	4856	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://miniigri.net/1223-senya-i-venya-vozdushnaya-katavasiya.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafda7ab58,0x7ffafda7ab68,0x7ffafda7ab78
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:2
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2180 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:1
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4552 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4716 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4384 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1828 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6116 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5532 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3120 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4508 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5180 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=740 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=6308 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6396 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2288 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6468 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6588 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6316 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6316 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:3196
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5268 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6928 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6936 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6336 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1568 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6312 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7072 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:408
- C:\Users\Admin\Downloads\7z2301-x64.exe
  "C:\Users\Admin\Downloads\7z2301-x64.exe"
  2⤵
  - Executes dropped EXE
  - Registers COM server for autorun
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7088 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=7100 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7156 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6884 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6896 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6764 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6968 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:2104
- C:\Users\Admin\Downloads\Сеня и Веня. Воздушная катавасия.exe
  "C:\Users\Admin\Downloads\Сеня и Веня. Воздушная катавасия.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5104 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6460 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5364 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1712 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:8
  2⤵
  PID:1008
- C:\Users\Admin\Downloads\Сеня и Веня. Воздушная катавасия (1).exe
  "C:\Users\Admin\Downloads\Сеня и Веня. Воздушная катавасия (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=6928 --field-trial-handle=1860,i,11829649527945643526,11627028104248250503,131072 /prefetch:1
  2⤵
  PID:4360

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3e63a4ba-d43b-436c-b019-31334ff2190e.tmp

Filesize
8KB

MD5
dc8c22d75996d901fad0d518953a31a7

SHA1
2754d91719fe03fbeb2eaeeed75cf2183544f0d9

SHA256
6f1604d85707d8c8957a386d310cdb7db1b5d4642c1c383fe096d89f0d8fc618

SHA512
e84e339c74f4b4a77ab3bbc643585dc94d9cef1c243d63cde1192189f21f91b0117440949d6fd1192734a2f154e9a85a7a00491a16b07c7c406c0a07dd4d497b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000043

Filesize
21.7MB

MD5
969e7c5c5af661003e1d3e2ed5d794a3

SHA1
311e95d27b81c438047b8528da3c328dcf3d6b3c

SHA256
495590ffb75123d62e8fffb39e58b5caaf6009f9dd645e3cee75a3c1864a847d

SHA512
767c58e77c180229d0ddf6e6d28b2a5c5c1fa11a87bb6d348f7382aaeeec0c429308e570f2b07d6a06e8d6f8378ca5ab905f934aab723488ec199a5c34157847

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000047

Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000049

Filesize
69KB

MD5
1aca9c8ab59e04077226bd0725f3fcaf

SHA1
64797498f2ec2270a489aff3ea9de0f461640aa0

SHA256
d79727a3a88e8ec88df6c42d9bb621a9c3780639c71b28297957ada492949971

SHA512
d63ebb8d19e6cbe9714603688bc29eda4e347e1bf0bb9b0b7816225220263781b84966413a946feb4ae27750371de01e03092dacc4051116073c518d6217fe65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004a

Filesize
323KB

MD5
1fe25d732b86b878d231b0f35438834b

SHA1
c21dc34b37ead88fb885798d1956e1dc7c04a5a8

SHA256
6a0d53052366b45128bf328cd476d4a308738b19937ef40f4f984c74d5b8018a

SHA512
c5355798ef19c0ee740af0a4f80aae08b6734277569e8a1ab3841977a0bf29c26550570c01c8740d16d9c5f9a2d0e2383d9c0715f55cfc9d7ce9cea0d7defba0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004b

Filesize
140KB

MD5
d83e968195ff1855b6e4a177a5f2f5ed

SHA1
f23015661b7584f61875f19e9715befcdec7f3ce

SHA256
983b1c14c17d6ed12fc646d7fe77c3193095afa8e5c8ebb391fbbd4a3accfdcd

SHA512
36cb6304a2eb6e3fde9a666943c3fe2c7b206a5f43b22c51caeaa7941ef43a095066fa8d36b6e2727c6e33724f78372ad666fb10b8e15436214e286caaddd96c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
202829709926490cef87ead20b5e57d2

SHA1
f6a198786f007bf5d69beba9f0b8c5554c338eab

SHA256
7a0fd7c7eb756bb9d4fbbf2bc8e5578b62de3210e05f5258ca275ba25084a3c7

SHA512
017f67805785316cdb242c8ea3c69bf0f10d611a51ce2024deab8109155b1ba7083e97974e7da0dc6e52ecdfc9d6468caa7c2c5f416d79ac530a32db3022e966

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
8b2b3744bb3529a1ceb4c34c71cbd246

SHA1
cd907416ad18c55e01ccdce479acfde0a77d5df4

SHA256
bb11ceb216b6611f8e3517102cc00db8cd26a359f453ba88d60d449f451b84d5

SHA512
2ee736cfda85c0429338a331016bc74a92ca0c4d4eb55a5709451c502bb84e250805bdebb3c62a2efc60a4a0f383fd087e858855400cc273273ca4c5c9d146d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7bb4b67f71482809b16e15b5cb45afdb

SHA1
8bc30c01a550fdcc3bbdad41683016940650a2e1

SHA256
0995dc6a5fc9a9837a9d1d01d87b66387a8be2d86b568c6987f458e4dda3e9b5

SHA512
162296e1072d2bcbd3f8eecd589dbfeefa0b733329fcd79d69e152314bf92fd416b655494ddc14f6279f0d79fbb66e5778a6eab5fd815743ee2035c416f1f8ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
be4196cdade8511b2183a7f27161c54b

SHA1
6eeabe143d053f42da7f1a715cf1ffc33014a33f

SHA256
3ddd7be9c8fa64c2d512405ad36c975f6cb96383b7f8d6623af7928e83425e8f

SHA512
bbfe4f4207b3a8b2d598e3999d31c28c9a4f260544bcdee6042b6ebaeed2b6758f767912badac633267293aab5a5c6fc27dac25f50ec3db5fea65fa91b7534db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6fed44ad7bf40dde4c0467cc0b756d7b

SHA1
a5ff42f5b04fe0c8458687f76797c990d7090cea

SHA256
8e4cc85fbf1e83123b7c61a4a220626f965eed51690313e0a1cc7241d33d51b4

SHA512
fc0e42c61d3ff8b78a64dbb268d0dddf7a734700164f6348dc744f5664321e6ed744f0af41e2244af475524484ddf5f1a804c0321a17491d7ade0272e05d5dc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4d02c1f63eebf1e452360a00ba5b9faf

SHA1
618eb6a739068de7492a4115d062f72eb7bf8e49

SHA256
30082be800212f6b8c152e67e66b63dc32f0205a71039031b61dd4736076c9a9

SHA512
e22199a512f19ee076ddbf496c56d8f623cb6b3542f99a5b75f8749956bfe568dda06a857234fae58cbb4f4d9ad520ed1bd1038cc1a3c4dbd389765b519dfbc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
00a30ce3aebef2881a3feeeacfe1739f

SHA1
f570dc2588a7e996ad305fdec76bea46f675fdf1

SHA256
52daeceff6370a617d7f6be81d0e45ebae5bdd4d529ab2be934d70db64f10cb8

SHA512
b0c58c72053b5c17824ea3acf4c9b38c2db72b110ba58fbcf591f2c1325dcbf5d0c1c9c0319598f008f621556e821cb4c4d6470e0d3365d806502e6e1279edd7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
348487c7238060ce494cdf31fde385fe

SHA1
eada80dcb5061ff2632d7cf93c475ee80a979590

SHA256
67fde045ddcfb7a0ef262a61b91f81e63b735e5dcd3433a7a2c8dd930dc0400c

SHA512
eb45e8819c978321fce0c90a0f9f205641b5c61c16b91efc4525fc63cf9993e681ae57d57800bc38ec7bf22e9d0559ef9aaa7b101ef1239b4fc2a0bde60f602c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
5018fe6784c158bc97daf4ff1d07914a

SHA1
3bb70abdfec813b7a0a63a2deb28678172750029

SHA256
2b183ad7273ac5adb73dfd049cef6b437a83a7ceaf64c002a823f952c25bd5c7

SHA512
44943e447bac56b43555e49458c329b3f9bc6b50bc95e51a6c8ee0e4fad942199478a8a1a62ea4f39dab216707b5fe759c487f48ab599a61fa885eb10cb6bbc7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
131e9e391ec15048dfd9083bfe12d34c

SHA1
582f46ffc5ef617e854892df14cb409da89f3cca

SHA256
640822fafe713263f9fedde47025096ce8ba93665b61c9361082fa0b1d49224e

SHA512
1f5db55df208f7e290e4bcf93de2478bfcae2db10a1a88150dc2ec8e58a36a1a4a4c28692fde3a21b6cf783e2a5dec8b7f800923aaa635c4d5d7131790186606

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
1fb814212890f9420d28bac42db6928d

SHA1
bf75104c6daabea5e255af2151c16bc7963d7b8f

SHA256
69f2c6abee4d0e061fdd6fc4005ccd2b49ade77c029fe36c83fd777453e3e63f

SHA512
8d43d0d2fffe61bfbc79bf8ea1cada099cf09b27d7af9f02ba164125b96eb2af42f45c7d75c10fe9ad1ca627d13b8e976dfdf5a7417e0176e6d8aa02040467bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
f84dd39b9b49f1839e0b5faad68c7fa4

SHA1
5e303d1394c264eb6d113f47bd84879d2e6927d5

SHA256
b237b9ae81e6caa1929d63d4f25de619fba7b3b6301991a21c837941ba7444f7

SHA512
a520ada39240e95030cb885fe49978d6ca85bb78664a7eaf2483c821d8c57f8bf66985abc2ad4db15a164a6e4e7c0c0b7a0c48aefbdadf1531729f3306ca85b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
695242d8fe14e980db39b3b9b65b4328

SHA1
4172e443c33fbab9a119a7924bfce450ac61853b

SHA256
0d838c59e3bbc694ddc2f8b0211716f4f38d93ff86ce382740cd2967bdc458f0

SHA512
58aec10e5881a13047968dc632a26094a34d34825d6e3da9ec8871cf951245951db065614488c9d6343ec015ef96808070d547f06b1d7fa1380922936df4b739

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
860B

MD5
82f72ec28927fb7e970880524751d151

SHA1
539e7326d41cac0f2793795fe2ca904236b46bab

SHA256
a6a60554fdf44e2d6f1a05c485da77fed9eed5922d0466c9cbc12972db458b91

SHA512
d40a4589f42591b6e06dfa8907aab2a0969e6c25f9070126faf4d178f25b80d212591178f65d3e05d1181df57869ecfedb0570f25ba3d4b1aa5fa30809f0a28b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
1568ce0f8e239510775b7e70bc4b5e2f

SHA1
4878715bd3ff07f7583e66db7589d3ce845f8e9b

SHA256
04ebd1cf1b485456680ef394730dda8390cbee85ba333bb8a701513f8dd03855

SHA512
f91489e20a1400dabab3cd572d33987e9e6a4cdfe0a553b06707135a387c94a9c8453d713c0ef0fcaeecec6cfc2cddbe25f6a8547fbbc13f532c8ba464557b6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
001bd8a725454d9a13c66649d5188f60

SHA1
0f037364c44ab9f337a33c880564f0455c8f7107

SHA256
b9be676b8507dfd9a7a0ab4435d9664240c0a0ebcedd8a070074a1278ffea361

SHA512
4f5fd6f804bd59490e2a4ea90e8188247934b853b43c85d839b7740d2873de8143f5dfbe2e64425d2e87b6a31b0c3ff47b5949f7f0cb80e80c4cf37724e7c25b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
e02c37a5483d501a2b689b569c1eb63d

SHA1
ecb0283c7636bf3396557c919c3acc4a8be52ab9

SHA256
e1e389cb747a1eff96c58fad01f9e1f22c2865b3c74f0d21e47d7267f73a6f5c

SHA512
bed38ffeb72d3cf47781e253434ec5529523779a411ecdc4432405ff0dc73404140e2ded3490bcafabf7115ff05582e75768b750d77632ab999427a6c677ad6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
0f7be899a65b815aa6696def1a5bb596

SHA1
0f18579b79a976ab1533ed8201a4d4c06d97338a

SHA256
ed1291789f4166de9b6324e28c8b0661cb05eab619f07733c25cb4abc05139da

SHA512
5681dff3812b23b5f5fdf3be94be2a1fd6a5e9433b82d0b063abd19fd76b6dae4c3dd13ba45e7ec5bafdcb2782fea6380bb99454e1e6dcb744883e90bec8c8de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
36dad22012b355187160742bcdedb067

SHA1
ca08a27a0792a67eb64d7ea1e2b2458271c6c4ea

SHA256
1d85c9c656098b9270b94d666470bb1f70668d97473039707f57c4d4c39e7075

SHA512
135e0e7a38c013c761cdf788278185343bff0b6698c0590b4b1ebcab54104af8c8154183318279f99291456415a111c7edfbf496571f74de798022722b044ba1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
876e72d6ed331fcc1c4182a7c3fc3b75

SHA1
2859cd3f492bf131965743b351729d9c488a7991

SHA256
a3b73da36c72457655654651b157f6d26a22f6eefaa710bc5dde82471e1ef2fb

SHA512
090c96d13a81e27301a00ba46d089e4d7dd6bb496ec8a222f92c12946a705dc65ad60d97d86bd6622527223117b548d7db458e7a272ac0a672cda5318de77cbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
ad5c9aa941551d12488cdbb195c37e49

SHA1
9fb0f596ee24321a7ca45a93efe4b3089f67f126

SHA256
d55771b46d6b2c2a99c5115ce107d3f449dc1b051f5641e0f8a301cc75c15e35

SHA512
71fe50fc46169667e3d11d258c2873d92b542a744077fc1b84c6183feca789fafa1da4a553f9719487e926f5c205f4030861627c2435568615c0fab4195872e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
8c920b042d4a3db0b67b8b663dd7b629

SHA1
e3ba07ad278c838b0b4b5254fff048b24eefd387

SHA256
d551984754afee61f188698cbd76d7c9f4af7a109561e44720affd71fa6de8f1

SHA512
6ce07616f08d7fb6b39e68d2b6b1209d228a7bfd0976e6cb49597b679a6e7a9bffc071620f6489fc61b6dd5692931fb4e9bf57d67cb83655c13380c9539e69e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d667f9feb539f47592b179329fd937ed

SHA1
1b3a939cd6fe5084254ce19a35fe151fa2f8dcf6

SHA256
027299d9d4bdf827e3a3856c4b65a19bbed53ad6de4b57f9fe664664b4ca67d4

SHA512
ad18fe808b08008bb529fb755aac5dab72e97cd78813a957760166630ab9aeb9edc6bfe6c43d3a6dd4bb18749c38de444f5f5469e65bfd75094dd5c59a6b456d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
ecd7f77b5c058b446daad37f9ed5397a

SHA1
4c0f8540fb67dc85f003418b8be994ddb3d4d133

SHA256
b362081aa439c7694621bde3015efc1f1a3b4bd7e42dcf61ad312f6ce2238ec5

SHA512
110b6bd99b98b8662706de772c9267d37616b076b244e4c477cab371b5473d68cd2ad1fa1acba2a7fe336f1b75d42c64e577af5d708bbaa12e5d453ab0c85b51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
94840ff0d4d248e1acaaff87d9e87e77

SHA1
5a20315f1c96a27af833e840509bfdd6368c0f55

SHA256
0f12f9409453f043849359d65a5cb36effc035f8d0b61ba41e71582bfdc6e168

SHA512
d1105d557c069cd4baa0f0c5b57ef2924cc3df62be9440934189258ea9e76ce6d0a6fab3e2c17266373d921baff3342c4572e314daa43abbc2512d96649da728

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
0e5560a9e8ef7e321b37af750585cd0d

SHA1
216988e16c197162a66b6719ed7d8708a5820154

SHA256
a93ffab4b1099e8be4ed194e75fcbcc4e45318d5230684dab2ba59e7b8ec89fc

SHA512
48521784d91844ecbf7d308ec3ad7b86c6ddd70da74de06f9e765560088f8c595e203da7ce14d24e5818ab7b4c5de9ffc6ca531284d5d80839652faf4b214a8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
64ee4ed8e7f0ac410dac603d12d697c7

SHA1
c826e666bf34b30e3826552dcef5b69b53c2032a

SHA256
3dc9d2c1ae97f7efad5e1d55c706caa86643c705b33c231d6e0a49d73ce62921

SHA512
2f99a97b31ef008d1e8614137626a8411b99b19a464c860ad8e5db90e9414c411d3a1ee3b7161eab0f26c368e4d33c45c93e9c927944da99d413134775ae6107

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
16744035965fb3067e47c236864b9164

SHA1
35b39cd6d0b643edf4b913484a2bf304ce1427e0

SHA256
45142f42e90cb51b830eca6e4e2c021e2ba787bce5a1950607d7875a844801de

SHA512
fb774133a617bd9aa8933bd1bae77c356cecbb44d2e153e4d5a475af5c26b5fd7b246c172537457f07702cd03c285c9041bba4dffbed0043c0cebb473a23cb66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
f26891aade991859d43c64d2c2e1c486

SHA1
97190c1801706c93294f556387ea310310c73852

SHA256
cd9a31c9a86daacc7d252384b6049429be2cfef1603389998f514c6c16c76bf0

SHA512
3818e8370b4c54ce1b8913386678c57d009302671a35b0bd8812633bfac8a0a92d1327c4d2338b02236c096f56ae062ff1d6e9be61526636db60030104dbf305

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
a822feaa8f477a5b62087413ec81afd4

SHA1
9ceadb4f5429a0fffecfe364cd6be50997d045b5

SHA256
2ef02f81873f47d48017db8521c24d2d18a50c1b6d3154f78754e086a944de18

SHA512
6c9047c27d2f8e6c7d46e9598cd905f40ec5b67771ae641851bc87f6ab52d455795c9995185ffaf9e5b70dc7f061881abe2f77cdcdd91ba9221df600f6e84c67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
9ae81344e22cde18a9144d75dbc67b49

SHA1
341868ee25c71ccef74735f135663485013cbbf4

SHA256
8fc1cdf8585404ba9a0b617e42977f0fcbef46ee6c93da9dfc2a9175b986ac3b

SHA512
1da0339df6b25b9e8f310d132e2e67c1f9a29e9259f8d9f434a17636f56f91814d8cea64927677ef6cd4d82d6572f282622acc68ca79bc04afe4cbb8e35095c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5febb77e98985abd8202d19cca2a9a0c

SHA1
b961a43d5ef74b9cc2c37cd8d6d9637a09d6319d

SHA256
3130c6597a4e62d778e3be3f1a15155b3bfa258d23704022667c98f72e4b74eb

SHA512
f040f39f35d7cb8add184d73c854dd142390f05573972c61b453cffed479b12243ec35d745d96953890c0b0f42cb812c69b6d732474d5a6188d64fbe7d8252eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
83e64ebbd80d7a2a4e37c6d842c11ab7

SHA1
15aea22afef7870472c3aa0b9118a8450df07f81

SHA256
6bcce73490a62b29ea608b2ece2a9820fe64c9566bdb15c60eebcaed16d665b3

SHA512
d1ea7d5d9a6aac78473dc8e98ab63fafcb68e88beee1a6709b45293875a42d9c3c67d2b7db20721233800c1a5e3ff1c57c69e8cc3a06179edfbf9e2569abcdc7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d05ba43c4a511e56119ec4e8cfb1de43

SHA1
116a2af8c7f6b89500146dea3e3e1bad42705287

SHA256
21de1829c7643ef7d9a264dc806a0faa193c7664e6b22190d10190842fd9fece

SHA512
1f1c3f5f36ddb45da87c561944c31ce5bca577a2070a6b52b0181c4fd99353ddd8f216645431dfae5b23d5492491491eb7e72a143713e4a146f62bcefd82f322

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
94275bde03760c160b707ba8806ef545

SHA1
aad8d87b0796de7baca00ab000b2b12a26427859

SHA256
c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968

SHA512
2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
120B

MD5
c0e11d3e6d3ecd84e9bef419ed677801

SHA1
6981a0f3f540650442d3d5d8bc6a0f1374eedace

SHA256
3cd543b5c1973a3af40a6f212588103f21edb0c8c252a49374ac0eeb07862732

SHA512
872cb9570bc283f24aec18bd6035cff63caf82cecd5520f58fb7cc51c8c805e3899216fb0b46530a0d4cb8495d2f1149d3619d54d523bc69aed7ae974bb2d720

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57536f.TMP

Filesize
120B

MD5
7d7c8c5dc07ecefd8727c6725131e154

SHA1
bf0e0e809f87fa35e11b5d33db11d30744f2d18a

SHA256
da2ea983dfda67e2995b8277bb7c90a7ebe81ab09a508dc1515af4edc201eb28

SHA512
d8ade76a6c53935cbea6f7f87d57bbfd5791b1223efe5cc9124fc1ccd2a1333bbac7c095485376e1496e704c11a73e8adcd61cbc6816da2fb0d8d1e4fff9430f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
1669cb0e716ee9e6ddb6f018dc8973b2

SHA1
ea6577aed6df7075b301d78c4628f84bd1c627fe

SHA256
f3bfeec39b10e63b732827f5f584407e3f6c97114bebf6f01b81342fba94d78e

SHA512
d57039982dba2c70c4ebf05818b85bc62f8334d3222c05560464210ae8aac800047d4969fb3b7bef250311067f942204d9eceedfaed2f6d7316fcd2719cf7fba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
5c0902ea953c7483c415bf16c36eccd6

SHA1
ac282312dcb3050e1e44d5035fae65629406ae17

SHA256
8b57cefb5e15d1ff66e6144c1c080f29960cc6ab71c919bc08de90e663135937

SHA512
5220b1b08c9771a8549ee70bcaabe15d32e9c2f8b0511c7d839adf9cd94cb4f39a3c293014f3efbd0c6499601fd1375ddcf1ee718e28527fd571444d98b7491e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
414200894fc0a9310800d73cc82bb321

SHA1
a21c254706d87bc65ea896163333542847498e04

SHA256
dcc0a616d21601300234bbd35248d32f5158871757367445595483a835e350fd

SHA512
e518b25a283c5f98fc54d94f455c371b9af9601453b8063a40f64da7cff1fc4c3d5aaefe3b0de4b266c20857994a7f9d94a92f48c329652f0e898d781f0eba1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
3a2a0fabe1d90b043cb48cb188ec2dd8

SHA1
0c97f1d5964377d4034cae57cd8797fc6a804597

SHA256
94d1537f201678de41393430f77d7f655e053de17cf326aa25a9c369b6e2d3ad

SHA512
31c81976f58f167d6c766ee3a3e38869c3fa92d53028e5b9a4e9ff0af0369313552d1941c4b9ba2a6c5dc36aac15176fb82e6adb5c774624f14f881afc22e6b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
109KB

MD5
786e6e65aa76a7d5bebe9a5fb4b0491d

SHA1
eca60964e2af803e28740f9fba64924e4618d3de

SHA256
675ba4cbf93df4c52707794fe0b8ed048e6c849cd41c4cc31aed3f22e7dffb84

SHA512
6f78668dc290768ac3e4c0427b9d9c0eb7e6db4efc2ae775f8da38d13d4c9737e12777c35eacba0b7c736fc795b6024afd79310cf6714d77a60066d85ead0864

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
fb8a474530fa5e2b34cd069417a266fa

SHA1
78e27126227c43d67d5a71d680a8af5b3c0d3df8

SHA256
8ed83da32b82838186fe53cb6e807082b45a310a070e85e49fbdd38cf9e7cbdb

SHA512
d563ffea94ebc7ef8a43b34634f624c212807d2717add50f1b4c6db683ab98153465f1b2dcf816da10da87ddb3efb9dbdcb35581e0289e47c63133d819a9d464

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5823ee.TMP

Filesize
88KB

MD5
ae89a56d2234bc0577aa49cff3e25d31

SHA1
d472cd2d9e693454fcb740aa1332282b79e69ba4

SHA256
a3a459c0d4f6e0ce3139fe2536bacab7fa088feb3aeafd0322bad06e3169665b

SHA512
ae0444da13fadfddf1ffae06be524aecde270676a5c56bbd00c08766546ba56bda1ab26762f2ecb93528473efdec6644288b197fe6d6a9199cc03f2d0bcee77b

Download Submit
C:\Users\Admin\Downloads\7z2301-x64.exe

Filesize
1.5MB

MD5
e5788b13546156281bf0a4b38bdd0901

SHA1
7df28d340d7084647921cc25a8c2068bb192bdbb

SHA256
26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd

SHA512
1f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff

Download Submit
C:\Users\Admin\Downloads\winrar-x64-700.exe

Filesize
3.8MB

MD5
48deabfacb5c8e88b81c7165ed4e3b0b

SHA1
de3dab0e9258f9ff3c93ab6738818c6ec399e6a4

SHA256
ff309d1430fc97fccaa9cb82ddf3d23ce9afdf62dcf8c69512de40820df15e24

SHA512
d1d30f6267349bb23334f72376fe3384ac14d202bc8e12c16773231f5f4a3f02b76563f05b11d89d5ef6c05d4acaacc79f72f1d617ee6d1b6eddab2b866426af

Download Submit
C:\Users\Admin\Downloads\Сеня и Веня. Воздушная катавасия.exe

Filesize
21.8MB

MD5
70b750f234d4ad4eecd73d2b937cd964

SHA1
1524a306f96afd1fb141e0f62b97ae8eeab1858e

SHA256
3854e61271b0f4a2a3b53a6ad2ed69a1d938c49236934fca55b5b568fe6bd829

SHA512
94f3875bc26eb6941a87cc69cccdf5cf418df3e106f631a5d7e26a7be6e1a2386d8c0f4aa4b5f0f130737917014819b0325e3e80760772323a9ba294265a49e1

Download Submit
memory/3440-1011-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3504-1048-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download