phemedrone | hxxps://workupload[.]com/file/zQGSnP5BtSq

Analysis

max time kernel
128s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
15-05-2024 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://workupload.com/file/zQGSnP5BtSq

Score

10^/10

phemedrone discovery persistence spyware stealer

Malware Config

Extracted

Family

phemedrone

https://api.telegram.org/bot6719312271:AAE1QFaFTcG0HSHiQXVv7gdDUMwSNOPMadg/sendMessage?chat_id=-4194654645

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Executes dropped EXE 5 IoCs

Processes:

7z2405-x64.exe7zFM.exeBritvaMyst_Cracked.exems_tool.exems_updater.exe

pid process

992 7z2405-x64.exe
4864 7zFM.exe
2100 BritvaMyst_Cracked.exe
3116 ms_tool.exe
1644 ms_updater.exe
Loads dropped DLL 3 IoCs

Processes:

7zFM.exe

pid process

3300
3300
4864 7zFM.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
992	7z2405-x64.exe
4864	7zFM.exe
2100	BritvaMyst_Cracked.exe
3116	ms_tool.exe
1644	ms_updater.exe

pid	process
3300
3300
4864	7zFM.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

7z2405-x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2405-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com

flow	ioc
1	ip-api.com

Drops file in Program Files directory 64 IoCs

Processes:

7z2405-x64.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2405-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133602533974067741"	chrome.exe

Modifies registry class 21 IoCs

Processes:

7z2405-x64.exeMiniSearchHost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2405-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2405-x64.exe

NTFS ADS 2 IoCs

Processes:

chrome.exechrome.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\BritvaMystCrack.rar:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\7z2405-x64.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

chrome.exems_updater.exe

pid	process
132	chrome.exe
132	chrome.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe
1644	ms_updater.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

chrome.exe

pid process

132 chrome.exe
132 chrome.exe
132 chrome.exe
132 chrome.exe
132 chrome.exe
132 chrome.exe
132 chrome.exe
132 chrome.exe
132 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe
Token: SeShutdownPrivilege	132	chrome.exe
Token: SeCreatePagefilePrivilege	132	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

Processes:

chrome.exe7zFM.exe

pid	process
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
4864	7zFM.exe
4864	7zFM.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

7z2405-x64.exeMiniSearchHost.exe

pid process

992 7z2405-x64.exe
2972 MiniSearchHost.exe

pid	process
992	7z2405-x64.exe
2972	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 132 wrote to memory of 3068	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3068	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3052	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3048	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 3048	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe
PID 132 wrote to memory of 904	132	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://workupload.com/file/zQGSnP5BtSq
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd4122ab58,0x7ffd4122ab68,0x7ffd4122ab78
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:2
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2168 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4172 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4268 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4464 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4712 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5112 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5104 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=6104 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4272 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5288 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4336 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4128 --field-trial-handle=1840,i,16247835707055432444,14523121849459061419,131072 /prefetch:8
  2⤵
  PID:4808
- C:\Users\Admin\Downloads\7z2405-x64.exe
  "C:\Users\Admin\Downloads\7z2405-x64.exe"
  2⤵
  - Executes dropped EXE
  - Registers COM server for autorun
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:992

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:396

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\BritvaMystCrack.rar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4864

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2972

C:\Users\Admin\Desktop\Britva\BritvaMyst_Cracked.exe
"C:\Users\Admin\Desktop\Britva\BritvaMyst_Cracked.exe"
1⤵
- Executes dropped EXE
PID:2100
- C:\Users\Admin\AppData\Roaming\ms_tool.exe
  "C:\Users\Admin\AppData\Roaming\ms_tool.exe"
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Users\Admin\AppData\Roaming\ms_updater.exe
  "C:\Users\Admin\AppData\Roaming\ms_updater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1644

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
3428b9967f63c00213d6dbdb27973996

SHA1
1cf56abc2e0b71f5a927ea230c8cca073d20fc97

SHA256
56008756553ea5876fb8aad98f6f5dbca1ba14c5e53f4fa9ec318e355e146a7e

SHA512
b876b39d030818ce7879eb9bb5ff4375712cf145b7457a815880bf010215bd9dcde539e7d0877c56558e0d23a310bc75bfb9d315f9966cbda4ae02a7821980cc

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
2537a4ba91cb5ad22293b506ad873500

SHA1
ce3f4a90278206b33f037eaf664a5fbc39089ec4

SHA256
5529fdc4e6385ad95106a4e6da1d2792046a71c9d7452ee6cbc8012b4eb8f3f4

SHA512
7c02445d8a9c239d31f1c14933d75b3e731ed4c5f21a0ecf32d1395be0302e50aab5eb2df3057f3e9668f4b8ec0ccbed533cd54bc36ee1ada4cc5098cc0cfb14

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
960KB

MD5
b161d842906239bf2f32ad158bea57f1

SHA1
4a125d6cbeae9658e862c637aba8f8b9f3bf5cf7

SHA256
3345c48505e0906f1352499ba7cbd439ac0c509a33f04c7d678e2c960c8b9f03

SHA512
0d14c75c8e80af8246ddf122052190f5ffb1f81ffd5b752990747b7efcb566b49842219d9b26df9dbe267c9a3876d7b60158c9f08d295d0926b60dbbebc1fa3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
19KB

MD5
8aa68b8dd90b7b474d9d743ae9585513

SHA1
27d41f0c4cc7783d7113d73ffa816c442b998a7c

SHA256
edacc6bf1bcb20f5533d8aa59b9d478795bdf3016931ac63e4396012ae0954a8

SHA512
2956ba7edfa41ceb108f1e43754624d9d7cc6cf2fb161a3ab4bc00fa143695b290a29fcb05d8bf0d8eb9860dc2b4ceac2fd0096873db357bf69c56d7462ca4fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
35KB

MD5
3f0a3329015911236cf93c2b20ceb263

SHA1
75d560d378e180108d86409b1bf8ecf63da04b90

SHA256
c097c93282fc1f37a00b96a9fd68a3e6a3d76177747a1bbbcd32495cc5f20e04

SHA512
d2849e06aeba4c125b1be57b0a688e00c326f651750c77dc2bf9967e944d0b7f550309498d4cd95819484a5c3b6d2352d5786f1595e040f6b0b058b5d94748f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
93KB

MD5
aba4d5de6fb056aaa13f28aa470948c0

SHA1
554b7f8d716f620281717e108ce928dbdaad2070

SHA256
71ea480631131b4f8e171a6fee1fb25949eacbd37db4c74fb8d23fbe98cafe40

SHA512
5da5dc8d1f734a5ad5766091906cf3b900ff0733499dca829d8f97fc9cf8cd1717f32722fcebddbfee5ffd515d07b288da0818e2fdbc8461031a1b3637eaf548

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
51KB

MD5
56c5ed810ac44481cb86e11b5a2f7ff3

SHA1
1b3a426b9066700ad3bfc159067eb0953a7149bf

SHA256
3ae38a5521fef15bef86d37aab513f9cc14c4336d1e3c76759470f87db6208ad

SHA512
5c7e1e56b481ee73fcdbd018201f095488c3955d6ab165f9a5dd30b1d158005778929d0c405a4c4da5350bdbafe5e91044af7f8796a63a2235b833c000d463b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
29KB

MD5
d7a11f18f6011ddd581ea26e1e724b3d

SHA1
75b4446dfda4bc9ceb7b3de6a359cbcd2b7f0bda

SHA256
5557114027c6099e6046bb71ba77b416c019dfa24a280951ebf83de137589c55

SHA512
c8a4441ec22d740fa8858bde8d36b848b21efa20c5e9213fe0564fde623b79104fcea49f1c5e9de181531b28024a954a7d0daebe7812131cd1def0235bfa26ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
54KB

MD5
f047a62a9fba5f1b66ced318b8df0d0a

SHA1
3d5e98f07354b0056c2f70fab5eab4382ab2d798

SHA256
a039005fcb12aee3f6db3b4c727433ead8048e693893a72008849b090f8fc062

SHA512
5e964a9e9ebc93861e14cf5b4464e9f04182aaf771991d01fbe0b4c61ecf7639810d5815ddf313aa406722d499d2ab0410858066feea3b094656c2b98477e5b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
28KB

MD5
a639bda9f61b66defea196518cb9b23b

SHA1
ae66f7a02cbe46bb128aaff9b22ffa542b3489b2

SHA256
53f1b277b06ccc89956267ab60bb6eec6a36f8fc69027d21df54b298e8af812d

SHA512
70fa94b96259b8ac31f78ad9a0d461505184480d3c46a627a11b01857e2b71f1b032c53f69838c4d769a74a8da70a44055f79211ef8adea03684788cbe4c8e30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3c0aae008185fb61160feb9cabb84667

SHA1
ad2ed748859818c0087bd134aa7b9112a41042e9

SHA256
2b688148210d98069a40223fe527fab7d63d9acc2e59216ca56657914ff628ae

SHA512
acf9fdcb1997fb63407784685c6abc477c25ca3cf6020e43d95a1c6687f8ba0fba5d511d47318300aa430049306173d60c42e2c70e3f63092a870280a7a75be9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
31a33e48c8893c4f5c668a886535931d

SHA1
e70afd0add0dd415865c93272867ea2cadde509e

SHA256
7e53f530e97b59a9947abc7cdaef6574131f8def632a07b1afdab03429eb0360

SHA512
a19ca3e6a4b7cc01b565283fbc305c0e0582f9649bfead9bb419f815538a639335856c0ced61a42bef7d3dde75cfff254a3891b420bd935e84cd1a482811b2aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
5591f71ed5cdf80d009d94cb13bfb1dc

SHA1
3bba7c71a73b991296a8bd0bdfc1296c41f4d947

SHA256
a6262e89eda7e54655774afc6d213b14957cd743d1d8b6a87c2a1cef884cbeae

SHA512
a6d0b53cc3952dcedb273b6da8aa6b10d2d122873de4b6341c09efcab030a45fbd7747f325ab7d96bc701ed727dd4419919780cf68d14dfab7f27e5bc3332819

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
93b3215447db909fe09544d358efa5cd

SHA1
765f87d57dad9e468806175405c374cf6bf452ff

SHA256
3340ae1cb0b70a99768489e0db0992a4db06fd25a6d5d32af499c715880773bb

SHA512
1df49b1ea62086d28af3ed1c767a2b02cf54fae6f5beff3c7608945284ab93025c31f5ebe0ac6b561b3968f755758af23b62590d8aa69ea1b2f18592ecfce621

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
22ad764a3df621d85a6ec1ed98adb844

SHA1
a49ae020e9f60095274528eb79a5647f0197b50a

SHA256
4e4de3d25207f87787feaddbf915a41e231bc142d79d07ebc4459b23931a5c95

SHA512
9173654fdd05695f7eb0f0e89f5d2c13c1d946f38c7d6c06af4d64dcc4b95cbc0857492af9d58999f2da742d565579fb4ab7f44882740268d40cfb9fc3a574bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
12fd51b1b335e4c62ea28533fc4115bb

SHA1
4b8a50b17825af2a33b8ff087d5217c7f429db43

SHA256
ab90c307656a68ee841e0871a31b3299d25accba385e47e6b0339b698a3cfb8d

SHA512
d93b8b3f82b1d7a6fe40ac01c2ec12fe0b9ceb4d78fc5df345029bc8f47ce7f1007325b44795f11d20adfff3a2e7d57ea178b659f448f1ad9d79b499c7b847c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
95d00d29a59d344596613c1868484f17

SHA1
f6a6eef6f91703c78ece2b77dbac1279379fc913

SHA256
7541fa623c6d095a2ff50bf45b3ca3c2c7bb910da3eae47c6f32518474798135

SHA512
3022f95734065fd27b17a6d6013371643ffd0fd015ce1568e66d1f8c82e098e8873624b5753d51fc577b88610b6350e12c0d28d44ef0a85c8d23e5776f17f1d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
42d910be7f33c5e8e253a8bd80c25dde

SHA1
356335916bd0dd66e537bfb8479c5d872af939b3

SHA256
73e58ce42de9fef48e1e2176c6d7d1103bf4964796f06ab9aa776d348b17da2f

SHA512
2e071d8a1e013eeb1c5da9fcfd4b8dea9f7e3cfa4c564edf760f4eb31875b3486fa02121fb4e8f7295180be3caf97de36aae8ae7eaf31d1b52b1f0377709bf6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
18e9884cac1f0258dae722c8fdd6eace

SHA1
d5c4d2955071458707376a7b8ea5a16970166154

SHA256
ea419828d71f637064de4b1d596d0cc9862a67ea6f363e5818724971c025cc82

SHA512
229d7a1db870239e1208bb4b91e6821d9aaa95d2a0bfcbe7c9213528a78a9742bb7864e99712c92096ca92bc703e09e189772392c58559b71795876356f55005

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2eeedfd917d29139b2d901df978ec198

SHA1
7b0334cd4b85ebb9c32baf4568ed4f078c5ff291

SHA256
b6f0a9ad835ef418718702900c06dc13239e9337c674e5a324ca97d025a01bc7

SHA512
491c6bcec125f2f654b6dfb011fe46453dac488bf4304d160458143e3f889b6edec3b2a5b46c6ca6b63ad0ac59a005edecef54d8fdff506e27e8f23a6a52d6be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6892a0915209aee38404df81d54c9422

SHA1
aed8f778f6483803b4f7059557d5d803a135dc42

SHA256
ab1b0eec272ec78b3281ca31f8f4a75b2fbc5f84063a477848070b48c26e3d50

SHA512
b5568be399e3923271908f1db8236c3886063328ad3c30ae3e32c4e9b69ba88a1b5dd9815c373c9f1c400706f82b49aac50c6a43558c652d0c9cf73f11336553

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
100KB

MD5
b9d60494cd1ceb0cdd697da45e9f4f48

SHA1
21390db1b3c87eec41ef1f5306af9dd70c163018

SHA256
b27473cbf7482403e451ec5113bffd90ad739a12c046b4732422c8e9477c2a0c

SHA512
f998cd9a3bcf39e1fcc66a0981ad8c2584f9aec2ba881a3143b453510e9c32c5d5e00a8d27ce4d569bd5293a622899456f72caf2d953fa74150afdb28b4e9d26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
009b9a2ee7afbf6dd0b9617fc8f8ecba

SHA1
c97ed0652e731fc412e3b7bdfca2994b7cc206a7

SHA256
de607a2c68f52e15a104ead9ecbaa3e6862fdb11eac080e408ba4d69f1f7a915

SHA512
6161dd952ae140a8fb8aa5e33f06bc65fdc15ce3fbfe4c576dc2668c86bce4a1d5c1112caee014e5efa3698547faad3bc80ec253eedb43148e36e1a02ce89910

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
131KB

MD5
0159426ac1a9e1828b11056b10ecbe53

SHA1
48d3d8fb2b365d1edc4840f0246eebd3359b460b

SHA256
24c6106e1fe64cef6aa04e9086b3c16431b73fe1f1838ceb6c39926512b3b62a

SHA512
cd2f1bcc3e35c803fec3378d5aa5f901c85bc765d0bcdecfc15f52d5e2f454fe33a656b0c53d95b4d8794c16ff7b685ec04eceec83d45107bc7d82f34df8ae8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
132KB

MD5
fb609d79502e16545a6c45a416b6670c

SHA1
e095f78f8138632bc4dc52aa85b1560b09c69ea5

SHA256
a95b8c89c9f25a19aad03c9f4aeb9661c4a20f1d1a5719259c7a4b51bd04a4ca

SHA512
93266ca4f39f6da3c33f88a6ca58070acfcd9c330297c91f142a7e87425de1756f5713336bc5752d2e385e42c9254dc0cbc945a42848a2887e4c4c74d59b0ad2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
132KB

MD5
1d006848fe98df2387171dfabe401e6d

SHA1
991189b89ed8f8ddaeb9e388a8cb16fc3521c43b

SHA256
554a1a1e99336afd83325d88f1bd56b38182d39315d6cb119d7eaeaf3d2953ae

SHA512
1053c39492cd50c40b326b9de96ab22abec8ed22384c4e1efc8fecd0845fbb29d1a20e24b85c69b52bce5b488a049cf459ac83bcc355614438bf78cddd2f7271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
016bb6481e51aed50bf8a46bc6a8635e

SHA1
c84b621b6830b2cd1ac6fc1ed4e34bad2faf73c3

SHA256
cca7e74e8d19585c99f6cbb6dd39a5e9899b95f027ec70037c7eee30aede06e1

SHA512
b25c062bf4a49dbcd24d7ccd5e21786f13aa8d44c8caf3cce7ca30a86a8019c8b48efee0f8d76d7616ca83de07cdefd6bb38fc86d448f758ec7b6c326743a9eb

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
e9aa12ff0be6d995ed86f8cf88678158

SHA1
e5ee38fc2ebef0fcbc3059dee29b39f7daf21931

SHA256
f35cd8ef03ac924a59943c5dfffc31ab67a8b5aff272e9f47ff776aabc7ee561

SHA512
95a67acd2a4784b87d73910c1f1f590937c9d9b901e98448556a37eb8137ae5f458f1c673d65a46cf7d6b90bee5fe6b102ce3eeac9e819062cd9c5c2418bcbfc

Download Submit
C:\Users\Admin\AppData\Roaming\ms_tool.exe

Filesize
2.2MB

MD5
de48cb18fd13425d160492753a06f8cf

SHA1
b287912adc72ed7e0d15e144d90dc0ea7ced0d69

SHA256
368d9dcc5a79af2bf2117a075da3806e604f25c9a818847b1e30184c2cfa384d

SHA512
23e061aa8f43d0424fdabde94d555b3ffdf8d1783f381f552d6ff8606ff1dbecc536bd8709febc5b327d4161c54520446926c4d5765fb84b1e54e38aafc81932

Download Submit
C:\Users\Admin\AppData\Roaming\ms_updater.exe

Filesize
84KB

MD5
940abe14a7e53ddd0acf11b1d88e1fcc

SHA1
9f30c56d0a02467f37e1d9316572fd79a720a92f

SHA256
023b92b6d19adee9a9b747485699a88a6f78ebaae1d333a8f13ec3b87f542a97

SHA512
c0caaf3c90a0428fa410ab4e19589b19dd83b06153e5d825fc774a312d3fdbb0896758e4ee05025a8175837e0072b991c3886fcf7fdb3e75768ea749f95c7577

Download Submit
C:\Users\Admin\Desktop\Britva\BritvaMyst_Cracked.exe

Filesize
2.5MB

MD5
d67c503eedfe1c4bfa778c685c68b605

SHA1
b5f93e660bf9cb45ec7fb71f94bb940eb1d34fc5

SHA256
c3dc8e92c9723665cf67712f394bf75a2423479e8b32f4cec1d5d3ea7317fe96

SHA512
cb34cfde396c7eed8d9d7ed3c9813e28b7e7862a17d3afce0caf6805208b79c46f542af8c94f606589d2cf243feef2cd6bf6d12614f096a591224c7364c98c0f

Download Submit
C:\Users\Admin\Downloads\7z2405-x64.exe

Filesize
1.5MB

MD5
c73433dd532d445d099385865f62148b

SHA1
4723c45f297cc8075eac69d2ef94e7e131d3a734

SHA256
12ef1c8127ec3465520e4cfd23605b708d81a5a2cf37ba124f018e5c094de0d9

SHA512
1211c8b67652664d6f66e248856b95ca557d4fdb4ea90d30df68208055d4c94fea0d158e7e6a965eae5915312dee33f62db882bb173faec5332a17bd2fb59447

Download Submit
C:\Users\Admin\Downloads\7z2405-x64.exe:Zone.Identifier

Filesize
110B

MD5
62551ad10354dc673777ff8c756e326b

SHA1
f6ac9009a07b819f80f840c080b26bf022f0534a

SHA256
e1fe3fe2e53bfdf6848e44f7d6d41fe27c12619815d7f00ff6714ba12857a8b4

SHA512
1f8514824c2edccf6c0463e1919b0b3cb57c88f17d6e4e6a8d10d3bcb045e0bf6e639a669630eea51b7aaf89114936fefb0b9b3877e118fb2012594778a50abd

Download Submit
C:\Users\Admin\Downloads\BritvaMystCrack.rar.crdownload

Filesize
2.4MB

MD5
36c922a94b48e408fe72965f97348027

SHA1
23be6daa4dfd8108efab16b552ac4f349c0dfb3e

SHA256
3d5c995ae65c8a6f4f612bccedbea95e1b22bd74f8520b7dc5e737514101c17f

SHA512
c8f4b0e221888bebe62b5f22700606a18800a4fe270090fafdf3d60d38fef521fdfec13f8acad99da405272b9387fd52f9d094100764abf93168161808391849

Download Submit
C:\Users\Admin\Downloads\BritvaMystCrack.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\??\pipe\crashpad_132_LUBQTHYKMTUPYMLZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1644-786-0x0000000000EE0000-0x0000000000EFC000-memory.dmp

Filesize
112KB

Download