phemedrone | hxxps://workupload[.]com/file/fkp8vSaWfcU

Analysis

max time kernel
99s
max time network
191s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
16-05-2024 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://workupload.com/file/fkp8vSaWfcU

Score

10^/10

phemedrone discovery persistence spyware stealer

Malware Config

Extracted

Family

phemedrone

https://api.telegram.org/bot6719312271:AAE1QFaFTcG0HSHiQXVv7gdDUMwSNOPMadg/sendMessage?chat_id=-4194654645

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Executes dropped EXE 5 IoCs

Processes:

7z2405-x64.exe7zFM.exeSoundCloud.exeSoundCloud.exeSoundCloud.exe

pid process

2920 7z2405-x64.exe
3188 7zFM.exe
1848 SoundCloud.exe
3168 SoundCloud.exe
4384 SoundCloud.exe
Loads dropped DLL 3 IoCs

Processes:

7zFM.exe

pid process

3264
3264
3188 7zFM.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2920	7z2405-x64.exe
3188	7zFM.exe
1848	SoundCloud.exe
3168	SoundCloud.exe
4384	SoundCloud.exe

pid	process
3264
3264
3188	7zFM.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

7z2405-x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2405-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

SoundCloud.exeSoundCloud.exeSoundCloud.exe

description	pid	process	target process
PID 1848 set thread context of 4876	1848	SoundCloud.exe	RegAsm.exe
PID 3168 set thread context of 4820	3168	SoundCloud.exe	RegAsm.exe
PID 4384 set thread context of 868	4384	SoundCloud.exe	RegAsm.exe

Drops file in Program Files directory 64 IoCs

Processes:

7z2405-x64.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2405-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RegAsm.exeRegAsm.exeRegAsm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegAsm.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegAsm.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegAsm.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133603162290999728"	chrome.exe

Modifies registry class 22 IoCs

Processes:

7z2405-x64.exeOpenWith.exechrome.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	chrome.exe

NTFS ADS 2 IoCs

Processes:

chrome.exechrome.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\alright prynce v2 fr.rar:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\7z2405-x64.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exeRegAsm.exeRegAsm.exe

pid	process
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4820	RegAsm.exe
4820	RegAsm.exe
4820	RegAsm.exe
4820	RegAsm.exe
4820	RegAsm.exe
4820	RegAsm.exe
4820	RegAsm.exe
4820	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4820	RegAsm.exe
4876	RegAsm.exe
4820	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4876	RegAsm.exe
4820	RegAsm.exe
4820	RegAsm.exe
4876	RegAsm.exe
4820	RegAsm.exe
4876	RegAsm.exe
4820	RegAsm.exe
4820	RegAsm.exe
4876	RegAsm.exe
4820	RegAsm.exe
4876	RegAsm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

3188 7zFM.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

2604 chrome.exe
2604 chrome.exe
2604 chrome.exe
2604 chrome.exe

pid	process
3188	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

Processes:

chrome.exe7zFM.exe

pid	process
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
3188	7zFM.exe
3188	7zFM.exe
3188	7zFM.exe
3188	7zFM.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

7z2405-x64.exeOpenWith.exe

pid process

2920 7z2405-x64.exe
648 OpenWith.exe

pid	process
2920	7z2405-x64.exe
648	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2604 wrote to memory of 4988	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4988	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4944	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 3552	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 3552	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe
PID 2604 wrote to memory of 4856	2604	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://workupload.com/file/fkp8vSaWfcU
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff9f90ab58,0x7fff9f90ab68,0x7fff9f90ab78
2⤵
PID:4988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:2
2⤵
PID:4944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
PID:3552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2156 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:1
2⤵
PID:1656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:1
2⤵
PID:752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4300 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
PID:2636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
PID:3636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4408 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
- NTFS ADS
PID:980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4908 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:1
2⤵
PID:3652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4328 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:1
2⤵
PID:4932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3256 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
PID:1032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3200 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
PID:2988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3184 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
- NTFS ADS
PID:5000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3216 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
PID:736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3228 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
PID:860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3244 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
PID:4968

C:\Users\Admin\Downloads\7z2405-x64.exe
"C:\Users\Admin\Downloads\7z2405-x64.exe"
2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3212 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
PID:776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1824,i,665130862865928695,7188866100546017329,131072 /prefetch:8
2⤵
PID:1636

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3984

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1284

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\alright prynce v2 fr.rar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3188

C:\Users\Admin\Desktop\SoundCloud.exe
"C:\Users\Admin\Desktop\SoundCloud.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4876

C:\Users\Admin\Desktop\SoundCloud.exe
"C:\Users\Admin\Desktop\SoundCloud.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4820

C:\Users\Admin\Desktop\SoundCloud.exe
"C:\Users\Admin\Desktop\SoundCloud.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4384

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Checks processor information in registry
PID:868

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2924

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll
Filesize
99KB

MD5
3428b9967f63c00213d6dbdb27973996

SHA1
1cf56abc2e0b71f5a927ea230c8cca073d20fc97

SHA256
56008756553ea5876fb8aad98f6f5dbca1ba14c5e53f4fa9ec318e355e146a7e

SHA512
b876b39d030818ce7879eb9bb5ff4375712cf145b7457a815880bf010215bd9dcde539e7d0877c56558e0d23a310bc75bfb9d315f9966cbda4ae02a7821980cc

Download Submit
C:\Program Files\7-Zip\7z.dll
Filesize
1.8MB

MD5
2537a4ba91cb5ad22293b506ad873500

SHA1
ce3f4a90278206b33f037eaf664a5fbc39089ec4

SHA256
5529fdc4e6385ad95106a4e6da1d2792046a71c9d7452ee6cbc8012b4eb8f3f4

SHA512
7c02445d8a9c239d31f1c14933d75b3e731ed4c5f21a0ecf32d1395be0302e50aab5eb2df3057f3e9668f4b8ec0ccbed533cd54bc36ee1ada4cc5098cc0cfb14

Download Submit
C:\Program Files\7-Zip\7zFM.exe
Filesize
960KB

MD5
b161d842906239bf2f32ad158bea57f1

SHA1
4a125d6cbeae9658e862c637aba8f8b9f3bf5cf7

SHA256
3345c48505e0906f1352499ba7cbd439ac0c509a33f04c7d678e2c960c8b9f03

SHA512
0d14c75c8e80af8246ddf122052190f5ffb1f81ffd5b752990747b7efcb566b49842219d9b26df9dbe267c9a3876d7b60158c9f08d295d0926b60dbbebc1fa3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
bd670cfd10a6dbc238cb883febfeb8ba

SHA1
d2af02ddb7fd099f5638e5194a91dd05edd79b32

SHA256
fe94e2ae029158ef8d62f875fe1902153e004cdf6da408ffb10bd51776012916

SHA512
67a4965b27233a08f04a2c89e666532a8a96d5dd3672879d1d35081f8b007dee0174496e0198a4316191b3e1c7c180753d7f98f53031eb2baf635e18e1303db4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Filesize
20KB

MD5
8206e525da6316e6a1b062a750955bab

SHA1
aa0b681f21b3bed10ac3bcee956d6c80da7abbc9

SHA256
bc16018c584db9deb8e996f386790894223078b92fdd91149e3c8715ca894d43

SHA512
40f0b11d4fa41a4d23ffffb05cef82d6276f3a81a70186ca435b4e162fe19105a6a82e24cc3af5dc098eb1ed7dca5bf6dfd8b9bf387d1ae15a95a3741e0d2e70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
1ae9cbc493eadaa8a8377d7a2ee67fcf

SHA1
79577ecfef510b247aa68edb48f2af3d0a8c1085

SHA256
7b7d77cb2086985447357fbd4e7bdcc94e90df73e0e197df02257ac103af8f27

SHA512
3f6a2b35c482e5ba45da9dd05b04feeadaf26fa75b205a44542f863c292aad38463a355fb0e95c75c462c65202e339187a222f931b704a9254274c2487fec424

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
16ef4370e535446ac1f72367179bbb45

SHA1
f6a1f7b3454a92f0550eac251642f555e9e239ca

SHA256
e87a187c5444cf1b8750dd088419bc3720c05dccf6ef87144324a5e8eb4ff5b4

SHA512
cc540f1a164239bde2c806f3fde34667c93ee1be529ef1318a5cb61a18da7bcfbde74595171492645d5f2383df4b2748721060db9f6b47b5a04a405ff6af7d64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
9a2a057dc2341e08eb4d29e97dc6cc5c

SHA1
e169fa36bd0e6e3120056fe575fe664868ccd7f5

SHA256
1451714f4de8bf1467f86f35808ccd8375f1c7aa90d031a0204b2fa11eefac51

SHA512
5832d5bff01879b1b2c1009623261ef2f7864f7963f1b7e2fe27eb4a8c25020fdd0d7deafe47dca2c704e22db34e32ed1997aed8ceb5b28d2b0ae6161ba19076

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
f097262867849492a1165aeba6524d28

SHA1
1927acebdb41c523fb0c1351110b6aa6e24df457

SHA256
12adf42011a0814f0c3b001314bbe0596533ccd701a1fb7bc7164e235e0269aa

SHA512
a424be38654a3b8dbbd282b9e5f7b2fa205d9c19f712ff675e453ba63c24b86e2538e41db58ca300f3217ff146b51091b4aeb699203d93f3a7d4a70297087ec4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
4bc16c809a283654150d4f3c06ba59eb

SHA1
42de2a9a60110a2791921b2cc0c68a909b234827

SHA256
e7429092339f6969431e072b087b05f908c0e1d9fcd02d0827aeead5607ef441

SHA512
65b6dd87c223b62586ae7a616e39bebd89870290f4939afb37da4033b060a572f5b2e1cc9c9391e6a6c3e72a5ff58dcb10882ac64247223cb7b39ca4e7769b0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Filesize
100KB

MD5
4c426446c3a66eda1ad3b2fe071deb51

SHA1
f8a7657fdb1e41a1d8799bec5213e92559011511

SHA256
21c1ac0326bb59769908fdbb87394b2adc6387f9a007a6c84edb7cd9ef10b3a0

SHA512
14f19021d4de4179723bd20ea7b5a909eb7dbff58e840e4df57cec26b83a71a2f1c750afe533747cb2f5f21a0a7993c1eda8050206f11cec3a53a0aaddf8448b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Filesize
14B

MD5
009b9a2ee7afbf6dd0b9617fc8f8ecba

SHA1
c97ed0652e731fc412e3b7bdfca2994b7cc206a7

SHA256
de607a2c68f52e15a104ead9ecbaa3e6862fdb11eac080e408ba4d69f1f7a915

SHA512
6161dd952ae140a8fb8aa5e33f06bc65fdc15ce3fbfe4c576dc2668c86bce4a1d5c1112caee014e5efa3698547faad3bc80ec253eedb43148e36e1a02ce89910

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
131KB

MD5
a2bc01d50ed23bc467cbf353ba83bca0

SHA1
b303509dc14b5b8e41c1df8924346462436fa255

SHA256
ccc92bcd149245a5da5d32ab48a2254186190629c741717c37ff8849e27f4677

SHA512
69888d4e3faa0da736ae090ad34fa6ae3c2df79592d12af3b1de72725c746f681bba92ca19b8032caa6c19ed948397603793af3b60e96526f40c4ee1ba98c4bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
131KB

MD5
ea0e94b91ee53431f3373416e8c792f3

SHA1
f7c538be58729ab0f0ae00c50f14205889b8659e

SHA256
9cc9cea4dc8c371195276b8d673a1c3ffee24bb1b02d9df58e9028efa6d0193f

SHA512
104330af10b1c0ba2051a696b44f64490c3e918b02e830192fac19758c9bb2370d7601aa3072a36983cca319287797dae588e9efff77eca7d8f8d55e10dc030b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
151KB

MD5
76471072db11737e4f039166e93112b0

SHA1
50f0753f9b25944e2cafd25a67da04a099fe659c

SHA256
d23507a77a753903d4a5449dec74ec332d01a3966d2b9ef875d58bc3150733b8

SHA512
fa64f99724bb1cd5bb045966f22ee433ceafd293f7c4ac42e185d6efd95a842de340159ea3c251e4dd53e6b9716e6c9ba10dfc6b836e5db4b03c4337a234fbf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
131KB

MD5
81120629ae626ab84558383dc56a39e3

SHA1
7d307687158c5c2461a34fac88d796fc8649226e

SHA256
8bd7fb54ec519e2e05f69109b4e4e0e8f866ae473d0cec7d96089484d03e2591

SHA512
512b77ce94a4260bc901c7412db8f17cae7b51cda331edec70a77a5d70f3ad2683fd679945c70105079a91296ae82f230835df7608bb106ac0968b1fadf18651

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
88KB

MD5
79cfa7b4bb7638364e735c1ece247192

SHA1
5f4ea71792479b491e760b8de0d9756cf4582f86

SHA256
3a1b1c3cce84b08d54866c0e66eb8f48fb6f91bb811d59fcba28ffe77a1446ac

SHA512
979b93a175783f6986ac24633aec94e2eb0a13fb86b065b52647b660d5fa1b84bf40978e840e805964b54a4081794349daf7c5400a2f94150c1146de7198a99a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
102KB

MD5
5cb911406ab0a14d34985425b7b1a0f9

SHA1
4037c0521592689ab899d52055d38ba881aa0c4c

SHA256
ffb89e1588f1798de4c8b3efb0d82c1d1256cc5f03df498bee144552ad6f9676

SHA512
d994ca4097ed747d1a8ba4e4dd28f3e04646a19fa8efa1727a08eab71b894213474d8d96382705c46a9914431e937793722ad73efef8c6856bf969ac9e2e8335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Filesize
1KB

MD5
8027da56b81b4be78ce34b4d9ed80767

SHA1
a3c2dc4608cac62684c7b7c64228bf75088ab734

SHA256
a9ae05be33bf31233ae315a7d97c24162b6c514b3634bee5d00b0a926e40f2e9

SHA512
486a7e1bd541e7a85ad9565910c03bb14a59052a9ade23afc03af11d9edb92c9339a2b78b066ba7fb1902da4f3be3bdbace799ca12e2c002b16ab2b30fdee840

Download Submit
C:\Users\Admin\Desktop\SoundCloud.exe
Filesize
182KB

MD5
75c4a5f827b71f386c836a00155b349c

SHA1
20a2552cd785f96049d4b524dd35c9897c3d9b1d

SHA256
964883bdeb50388f7fe56cdadb3b81009ea8c0ad78bb2f832b267b163981acf9

SHA512
add872232df95c4191be4c89b7ea25b64e395521c4d627759905bc34378353f0dffff2440156d58989e53bc0c331e97edb1415ddaba37c1cda92c82b61dd7584

Download Submit
C:\Users\Admin\Downloads\7z2405-x64.exe
Filesize
1.5MB

MD5
c73433dd532d445d099385865f62148b

SHA1
4723c45f297cc8075eac69d2ef94e7e131d3a734

SHA256
12ef1c8127ec3465520e4cfd23605b708d81a5a2cf37ba124f018e5c094de0d9

SHA512
1211c8b67652664d6f66e248856b95ca557d4fdb4ea90d30df68208055d4c94fea0d158e7e6a965eae5915312dee33f62db882bb173faec5332a17bd2fb59447

Download Submit
C:\Users\Admin\Downloads\7z2405-x64.exe:Zone.Identifier
Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\alright prynce v2 fr.rar
Filesize
135KB

MD5
6522c1ece1df708e08d37f9f354ce29d

SHA1
5174670de1c95518ac9575d1717da2965542d89e

SHA256
c63e9763cdc05db1a65d6bd24c540fffdbbdf658e82245ef0acbeabe0918b6c8

SHA512
4f607c2f1e9ab172abe6929385582f27ee3e1ada57e15eabcdfeb4e2b2898c7e06962a2dcf1500263e38466affe153d4ffea03e01bf075297589a5c7ead066b4

Download Submit
C:\Users\Admin\Downloads\alright prynce v2 fr.rar:Zone.Identifier
Filesize
120B

MD5
f2d2e150f40b59967a7360c3190a4ce8

SHA1
144f890a4742ddd050ecc9b997b36142d4d66c22

SHA256
90929a8ed184308648f2c664017d7136eae910d8c046384c92bf32dd690b55eb

SHA512
9d99677832234510159a1bd1ae492670f7e903f8fb59f577abbd747acfadc58e34dfd883648ca6af7128dd0e0f16fa0cb76ae5cccde976de1c878f5c7cf415ca

Download Submit
\??\pipe\crashpad_2604_BKEYQNCWQIMNMAPZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1848-503-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/1848-501-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/3168-515-0x0000000001300000-0x0000000001301000-memory.dmp

Filesize
4KB

Download
memory/4384-519-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/4876-507-0x0000000005CF0000-0x0000000005D56000-memory.dmp

Filesize
408KB

Download
memory/4876-502-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4876-511-0x0000000006690000-0x0000000006722000-memory.dmp

Filesize
584KB

Download