hxxps://malwarewatch[.]org/

Analysis

max time kernel
286s
max time network
287s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
08/06/2024, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://malwarewatch.org/
Sample240608-rh7descc9z

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2552	[email protected]
948	avpc2009.exe

Loads dropped DLL 3 IoCs

pid	Process
948	avpc2009.exe
948	avpc2009.exe
948	avpc2009.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
70	raw.githubusercontent.com
13	camo.githubusercontent.com
17	raw.githubusercontent.com
64	camo.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\antiviruspc2009\avpc2009.exe	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\bzip2.dll	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\bzip2.dll	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\avpc2009.exe	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\libltdl3.dll	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\libltdl3.dll	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\__tmp_rar_sfx_access_check_240817421	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133623300460515703"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3938118698-2964058152-2337880935-1000\{00A11651-4D52-4FA2-8AE7-62580DA74161}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	chrome.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\7zO4F49B96A\[email protected]:Zone.Identifier	7zFM.exe
File opened for modification	C:\Users\Admin\Downloads\AnViPC2009.zip:Zone.Identifier	chrome.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	72	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	73	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4628	chrome.exe
4628	chrome.exe
4412	chrome.exe
4412	chrome.exe
1268	7zFM.exe
1268	7zFM.exe
2628	msedge.exe
2628	msedge.exe
4068	msedge.exe
4068	msedge.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1268	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
1268	7zFM.exe
1268	7zFM.exe
948	avpc2009.exe
948	avpc2009.exe
4628	chrome.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of SendNotifyMessage 63 IoCs

pid	Process
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
948	avpc2009.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
948	avpc2009.exe
948	avpc2009.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4644	4628	chrome.exe	77
PID 4628 wrote to memory of 4644	4628	chrome.exe	77
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 3728	4628	chrome.exe	78
PID 4628 wrote to memory of 1768	4628	chrome.exe	79
PID 4628 wrote to memory of 1768	4628	chrome.exe	79
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80
PID 4628 wrote to memory of 3440	4628	chrome.exe	80

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://malwarewatch.org/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb0f56ab58,0x7ffb0f56ab68,0x7ffb0f56ab78
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1624 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3748 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4376 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4372 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5040 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4088 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3984 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4372 --field-trial-handle=1816,i,4757367973342250018,7214234630202945735,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:4344

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1724

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\AnViPC2009.zip"
1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1268
- C:\Users\Admin\AppData\Local\Temp\7zO4F49B96A\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\7zO4F49B96A\[email protected]"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2552
- - C:\Program Files (x86)\antiviruspc2009\avpc2009.exe
    "C:\Program Files (x86)\antiviruspc2009\avpc2009.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.ru/1001
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffb0f283cb8,0x7ffb0f283cc8,0x7ffb0f283cd8
        5⤵
        
        PID:3832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,9521915264074227515,4427592925605176392,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1844 /prefetch:2
        5⤵
        
        PID:1948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,9521915264074227515,4427592925605176392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,9521915264074227515,4427592925605176392,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
        5⤵
        
        PID:4720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9521915264074227515,4427592925605176392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
        5⤵
        
        PID:340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9521915264074227515,4427592925605176392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
        5⤵
        
        PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avpc2009.exe

Path C:\Program Files (x86)\antiviruspc2009\avpc2009.exe
Size 9.0MB
SHA256 9c42eca99e96a7402716fd865b57ea601fb9a18477fe2ab890bdbcd3052f68f8
MD5 c18a7323332b3292a8e0f1c81df65698
SHA1 bcb8f34cbe0137e888d06acbcb6508417851a087
SHA512 4d48d11f3d0a740b9193e17782c77b01f52dd6e8324755aa81188295a0caed0718d330453bb02ca8bc942ee5588928e57a0d89d90d6b1c32690338c5eae8e1ad
SSDEEP 98304:akMZNqXXZh/M7Y13c9FAddv2z6/HsRsUrnlBvaFOUREPaRZMF6knx82R617:k17Y13c9AvWaFOUREPaRZMF6knx8Q617
MD5 SHA1 SHA512 SSDEEP

Submit Download

bzip2.dll

Path C:\Program Files (x86)\antiviruspc2009\bzip2.dll
Size 67KB
SHA256 da25db24809479051d980be5e186926dd53233a76dfe357a455387646befca76
MD5 4143d4973e0f5a5180e114bdd868d4d2
SHA1 b47fd2cf9db0f37c04e4425085fb953cbce81478
SHA512 e21827712a4870461921e7996506ffe456dd2303b69de370aa0499dde2e4747a73d8c0e8bd7d91c5bbc414ed5ee06f36d172237489494b3dd311ccd95ba07ebc
SSDEEP 1536:S9FWW0igMY08p/41AdhEfWoh8eGf9NvvvvvvvvvvvvvvvvJQfBq:S9FxMJj3EWne290
MD5 SHA1 SHA512 SSDEEP

Submit Download

libltdl3.dll

Path C:\Program Files (x86)\antiviruspc2009\libltdl3.dll
Size 34KB
SHA256 f9c9d2b92efb80f6d11df52735b8bddd099847cc79ba56650793b21a0923b1cd
MD5 00a71b4afda8033235432b1c433fecc7
SHA1 d7b0c218aa8fec1c60ada26a09d9e0d9601985ca
SHA512 96635e66d9781ad4d2414271f6a0904cf880ed94fc19186ef4da5f88f24e14ef1591fdc90e27db15a6021847c592688d0034f20e2e50ca93bf8c6db27e8c510a
SSDEEP 768:IZw9E10THMXYyumdlZ3+aJdKE/z85TISX+RfnW:IC9E1yHMXNfdX3+TWz8WRu
MD5 SHA1 SHA512 SSDEEP

Submit Download

pthreadVC2.dll

Path C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll
Size 84KB
SHA256 8aecab563b3c629e8f9dcd525dc2d6b1903f6c600637e63b1efe05e3c64d757b
MD5 0ab7d0e87f3843f8104b3670f5a9af62
SHA1 10c09a12e318f0fbebf70c4c42ad6ee31d9df2e5
SHA512 e08e17167edf461c0fca1e8b649c0c395793e80f5400f5cbb7d7906d0c99e955fcf6be2300db8663d413c4b3ffb075112a6ce5bf259553c0fd3d76200ee0d375
SSDEEP 768:bspjN7masPcbmZOzyKGdsmkHtpwpSH3UMp4K0/06gZiH3YbcZ8ysAa23Zm:eOEEMzHtpc2l0/0JZiH3YbcZ8lh
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 cfb53f67ae72f2777fa2aedd3849d8b0670f46fc14e0034e9ad2ad30e202d380
MD5 f8f4d3c11e588c92964a6c8317bc2e0d
SHA1 684131ae60b23bc021a69616583f389cc93119b8
SHA512 ec40dca00022214d1a0ab96a92576697085da671666b59cef5f15d303a1d5cdab980ea2c0d5c7996a4d40fe80cf8983f33f918b5bedcb66faff336ee6e45eb77
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5db0972d0b5bc27d00735d04727d0864311fc58015550ec9ec86843ba95f4270
MD5 1d5c4a8deaec2b590496ad407f6ef402
SHA1 c41254867420471755788b89b8cb3a0ef7f4afcc
SHA512 457be354027ca7e7360d8bfe7530ea022137c810fda47ee1ff5cc5e307f16940430ca268303abe41aa7aa27602fc8ca65c8ccdf82f2f7e0340317ae1e262329f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cab532538c9b0eb195ab78028d8a594467e0118dd30b056beff8bd935b370200
MD5 9c1f602b3862c43c74e153b50bb60413
SHA1 28b52446996376a196a5d58add5f139103aefd7a
SHA512 2154d895ac3b539aa88b3e2690ab9d7dd96967e335f6b07dd845672923f95e70630c21be70162bf10489158a5d77a92818c8bf191ee9e95e64eb163241a42244
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 75eb60b35246308b50e823ab9f06c4c808cba8100c688da1a19411dea241c02f
MD5 936238f166d8d4d72c07c8394ace264a
SHA1 8a53f16178ce2b8aca3e3fce610ab2dc91e8cb21
SHA512 de5019ab7e36c9a21a3b6674195c9fc39f7f69a506f18c1dc12701335ede0af4f4c6c7143235c7b8e6a7e225d5f93c90538beb362e2cb1eaa5b353202cc697aa
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5cfcd505ed91221503e1c52ebabc612063a537038d65cd2f40b997127c0a7161
MD5 2941c444d1475af66cb97356bdde3f67
SHA1 13e358af37fcbbdb69d6f41428ac1b8e9401d4c6
SHA512 c8228d275837eb19d1ef95997f635f5eb77f4c09ddb7d6a91f42bdd963bb630613f756236741d4072a061975bd65604e2dab726b980336e1e1c3acb367be456e
SSDEEP 96:FHaH0HzHaHwHdVHzHHH6r5HjHrHGNHGeAHGHEHGMHGE5HyHG6EiHGIHG1OHCHaHa:FHaH0HzHaHwHdVHzHHH6r5HjHrHYHBAv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0c95d1a089b5e227dce35d3ddb21323da53306e7cb99f483d1a281a696dba92e
MD5 bfd852140307e8b668ad18fc1b53a37c
SHA1 b43f2579ab2f06f0f14f801a4782fbbc4e96d6d0
SHA512 2e942bed97c82ba83cb2457e487f5692e2311cb59e3dc557e2a44f8608a70278452b0c2b648130c1e77f6db8ed809f4527a3c96c33999ba57b78a0b23f583746
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9c43f642e55a109a798f986e7cb394a9fb58f095f8b43cf82119d87f0bd7506d
MD5 18968e232668779fb78d48946655060c
SHA1 e256cd28378f5e6b0c216c6cca06f1b1158f9dd3
SHA512 c72a79576f0b549aae06d090488df2e8d653f44011a5d59f8510e97e2835ced459c81938972707965f293e339c4be609ffcb799a6b38c214db7d2a48aa57ead5
SSDEEP 96:FHaH0HzHaHwHdVHzHHH6r5HjHrHGNHGeAHGHEHGMHGWHG6ERH2HCHPHNRHGpHKHU:FHaH0HzHaHwHdVHzHHH6r5HjHrHYHBAZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 3ec630b113ebda06a599c85d257771eaeb6d06d06808724bacc42b6d6cfcb272
MD5 370287614fa758dc8c8322f5284fba37
SHA1 93fb2d943d52a7068c1bccf2ec7c41d24fc249d9
SHA512 874b30db4e7b05ce6e57af8c4d8c7b60dde2fe124f4a88e00c55ded175162b3a411cf1df90034739f4a265e408d3b14d29d9f21b9154b93335eeabdd5f6ad8d5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 ff7546625f78860889b0b878768004c80600a6964c4f975803e011e9060d4c0f
MD5 a36f735f33c1919c425c57a86360cd4e
SHA1 72357dae9811ba803aedc4823e33a484be2c0543
SHA512 68acc7cc3dc308ffab6dac09a7bd4d1c7afc6d94a94bc4b94a0c8dc2657cf166df0b0503fc6ef1ff809ac88af3114112f11a9dae51fa779e7e81bb8794fe77d5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 855B
SHA256 4f9cff592a1e269e29fdcda23f6058386682b0f75edec6b390c3334d2d63ef11
MD5 cb720fae7be5c7240f9cc907640c2c83
SHA1 a7be6ff95ffdc0d9bdfae6050b655fe83f006bb1
SHA512 06e4890023fe5dfd589f815a1edea479318db24df074a3be8146a502d22c1f7720399a63aa784dc4faffae4e2cd8200c0a9e5db7fd365f9404ac227aaced862c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 03f57a87846cdf567148f345c47a17ae70320c81cd41fc01e04ddd9cc091466f
MD5 4e5ec82bfa06d736efbac38102c441ac
SHA1 e1759e1e50ac6917e40bc17a103fd64bda5e0205
SHA512 b3a7b54ceef29c30719b77190f48f61b94494f85bd26d9227bce37b8e1f3e77f44b9f55bb9d521c77d7057a25b8a9fb83780407ae0bf28d8aea988259d8861d4
SSDEEP 192:C4XdeqV8aJyb8syh+FI5T8Yg9rd5tjEsXtScR:C4XdTvyNyqWYZ9ntIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 8a130ab3d7982d83a3e911bf28c6d9b039460fa641e496932cd59a39cc65b457
MD5 3a614947e4724a48467c233162fe4319
SHA1 e9c54c3f81f906cb95ae9668a3d03cad060d22de
SHA512 7fbe9e074f4e67cceba0c68a83ac64664d4fd84be77a83df8885c84ecdc954356bdde03dd00e89910a79e98869dc99fe6e3d9f028d130e2f79ef0ec52197c894
SSDEEP 192:C4XdeqV8aJyb8syh+F75T8NgHP5tjEsXtScR:C4XdTvyNyq1YeRtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 7e8694aa6ef3dc95bb8c5db6f0b938c4baaf1cb98fb47c9e596e7a5a3e5fdc4a
MD5 5daa3aa9552ea98a56e1931a9fb70213
SHA1 7576be52c6949e4500a1dd9848f4606c7c6708c6
SHA512 a00d76d1b07d9366a8daf9af2dd60777a4ad94ede91b523ee48e0e7b3452a85c9f7dae2e7515c240ba231e9d10c7dd02cad7cb1b68e02c98aabc7b1cd525774f
SSDEEP 192:C4XreqV8aJyb8syh+F88AgHP5tjEsXtScR:C4XrTvyNyqPxRtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 56B
SHA256 c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968
MD5 94275bde03760c160b707ba8806ef545
SHA1 aad8d87b0796de7baca00ab000b2b12a26427859
SHA512 2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5736bf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5736bf.TMP
Size 120B
SHA256 43ade3024297a57ab7f73d1a8d09b1816e97864fd04d6f72817ad7a14378129a
MD5 3fcc3b418f08e0af01661fad4cafe5ae
SHA1 ec8176c675ab3b8efdc795d2712293e12559f263
SHA512 4c6c5573465e8be2a1963cbb26535e7a165a63d4fbefdbe2af30b5cc27a5c7eb759ddc22b0e7af607d1ac1a982fa7d05df0619a7cbceb8f50ddaeead6a73ee3c
MD5 SHA1 SHA512

Submit Download

f5ce93ee-9dbf-4e76-ac24-9a8cddf6844d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f5ce93ee-9dbf-4e76-ac24-9a8cddf6844d.tmp
Size 7KB
SHA256 e45322d5d8532399a58b3c8d6d451f5af2ee4af215682b26aafe612418d7e961
MD5 3ca274a8c1b8a7b3eeff7cb3a0fc8e23
SHA1 3bd016d970a8f7fb53c028a6ecf6cfb019e9fbb4
SHA512 73a799038ebe0dcd7243f675dfd2f39ab8bcdc2b838ae44a3d2171e1cfdb6ec04f4b800e000d0f6427662ea52aa37f08783dc41c896eb2cae49c77b41eed6f95
SSDEEP 192:C4XreqV8aJyb8syh+Fus3gHP5tjEsXtScR:C4XrTvyNyq1QRtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 256KB
SHA256 a46dab259d218b7865c1d61fe3599fb7cab448af3cf9cba6fd0fc6a3fe74b62f
MD5 dd6641e3f08cac152801edcab445d975
SHA1 15568572142a1f72c150da63e1afb7df3491dccb
SHA512 bccb6be45a0e42809cdea3235ef8ed8e6d0371a301c852ac9f6b3207e3dd9e96d69f3aa00013f4b95278a115eb4d22a1e5999c0846e82f53a6f12e287f5f3091
SSDEEP 3072:J4mD0/lgDm4/AKxAaTmk+Vpne9T1UdkbmSwJHiy3zgZoOqJ72dxqXQqd+9z7MAHj:ymD0/U/RVVIFe9T1ckSJ73cZDwwHNHQq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 256KB
SHA256 6dfecf2227f44161981fd724fb6dd9ea49a0a74db651946da8dc5b2206f6691a
MD5 757bfc3ec2fba26747a796c7a41b7e72
SHA1 2818eaad415d1ef7703f196956385f0b8a4798b7
SHA512 b7668e1a7ea41fd5db1aee3fe7ce694724731f737e973cbf32fda00b3ba5ae67a4457382395155ef951a4661b8e317fe3144cfed7d64c9b90bc88674c0d07a31
SSDEEP 3072:f4mD0/lgDm4/AKxAaTmk+Vpne9T1UdkbmSwJHiy3zgZoOqJ72dxqXQqd+9z7MAHj:wmD0/U/RVVIFe9T1ckSJ73cZDwwHNHQq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 92KB
SHA256 d7807ab524752524ee5ab20d22b9835f8ac96b05014d338c517d22fb1e16cad0
MD5 9124cf94951da7864c5e0ef9ec0bfc40
SHA1 ae82b2521def26aff16a2a295ed1a8e51ec007fc
SHA512 9c404903c530405703ebdb70bcf2ebf79137d5213b9d1323ccf9085ac407dc24f51ad51a7bb94fa8f051eb5d6f1de38f93a245fe0c5232ef131360c093f4e9c7
SSDEEP 384:3boRxEQKphDsSmKpvM1DVh+0NQxg8NXDoIvPLz1cVMZpLHcj14iQeLsD2NX4QVeA:ciQptSE2XlE3Dm1KmBS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe5a565f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5a565f.TMP
Size 83KB
SHA256 0453cf3bedaa35b972ba9ec8e6054ace0d5767fd55518107547966ed14dceda0
MD5 d54917e5c92779891aef41e08f087b15
SHA1 39ec596fe36bacb3044ba665f0c8e3e4a90db5dd
SHA512 7d9fd9b8cd2e3cba2a89299bb2ecb4d8892221f558ce2b098c21d7b289639dda72f62a3ed76c05f1568b6c3f74428a34807bcd5f8e1e1cb7b1558aa4416f69ac
SSDEEP 384:WboRxEQKphDsSmKpvM1DVo0NQxg8TDoIvPLzdVMZpLOj1uJLsD2NDQVeWhyBX/3v:ViQpt2Ecclrhbm1KmBY
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 c66f13781b6cae2a0dc83ea6d1ae073c4b5c68c73c0e0d0867bffbe81f383c39
MD5 b6590bea248078994aae8e89cc9ba5a2
SHA1 ff541b45a350e7049c66868757213038e79ca46b
SHA512 7cc0fab52aec4a6034579450a69f17ebce88ab6f1a0c39141a9a7a3fcee11d1729abaee6e945b7b9a13c6acc0c3118167df8733cba51ef1c035937f68c61baab
SSDEEP 3:MsEllllkEthXllkl2zECllVMSdK:/M/xT02zh3Mu
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 402defe561006133623c2a4791b2baf90b92d5708151c2bcac6d02d2771cd3d6
MD5 34d22039bc7833a3a27231b8eb834f70
SHA1 79c4290a2894b0e973d3c4b297fad74ef45607bb
SHA512 c69ee22d8c52a61e59969aa757d58ab4f32492854fc7116975efc7c6174f5d998cc236bbf15bce330d81e39a026b18e29683b6d69c93d21fea6d14e21460a0a7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 00dfb1705076450a45319666801a3a7032fc672675343434cb3d68baccb8e1f7
MD5 046d49efac191159051a8b2dea884f79
SHA1 d0cf8dc3bc6a23bf2395940cefcaad1565234a3a
SHA512 46961e0f0e4d7f82b4417e4aac4434e86f2130e92b492b53a194255bd3bba0855069524cd645f910754d4d2dbf3f1dc467bcc997f01dc6b1d8d6028e2d957236
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 302B
SHA256 79b3597c5af0a4ffda3c78f6df91f9dd8d7e3ee03d1195e1aa3aa9ccb6dc1aac
MD5 48fca9d73458902e83021477e453b46e
SHA1 7c106a9c8001f261513f6da08b74a63961f7c998
SHA512 334f17297fbbeb45278edf41c811d6c4e0cd8a2951766de3f2b99519524f11c8e1468b8d3481f68f16fb144043f755158f59a78bccfc7a4788db7b9207795114
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 73563f442786f0b0d4a8da1cd37e94185798f7519e8905357b0847a71e23a471
MD5 6e1aa79fc62a118dcd3c0eaa3a2e8ad9
SHA1 d924ed95d03d66be12cd71e87e74f808141851f0
SHA512 9908acf3a829eddc2f9386ccaf5f886b1eabb9de75b1b73e111d8b5440172e24974b41c27fd1e47e9e4162fc6b3fff4030763dd30227e2795a47cc86344f1775
SSDEEP 96:nkk37gBzkZ83wSv0MoiVmdHIdJ20WQyV+VpziX3wI3:nkk3cBzkZOv0MAIH2Lx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 83523f47da4df6df4b34fc8421fcdfa5a0718812374a50cde5a2ce982748ea78
MD5 e045cc223f6f41bd4b6439c8f4816e30
SHA1 9f633bcbdb6f17b352002005de2cd12b1079463f
SHA512 3c266e346d261ba5ad175b8f91746bee8be083093e4551aa9b4863244fd6cdab50735d2128240ddc05fc4f159a375cdd793fcae08442c3afe488f1578cdcc619
SSDEEP 96:nkk3HgBzkPd83wSv0MoiQR5mdkuT1jIFJk0WQyV+VpAiX3wI3:nkk3ABzkFOv0MQpuThI/kLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 25f37cd3ed0fd4d8acd49907eed8ad412f1eabf1392740db2c64a1003e54d762
MD5 fbcdc261fe25112ab7bcf211c3c94b85
SHA1 43155dc5089cfb4c7f8ead715f520d7fcf59dc6d
SHA512 3043f359f54134f8b9ac38aa01974291208ce3f8fedbd236705c06078b8b1b98a094f6700b570cf2609629ba4a91f2ef3b27dfd3426b1bf19422ee472bf9d1db
SSDEEP 192:9oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGgQSxe2RU8MRWJ7YvmljEW5j1:x9iIxuERzA83h09RZxASGoTdJ7Yk9rbT
MD5 SHA1 SHA512 SSDEEP

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\7zO4F49B96A\[email protected]
Size 1.2MB
SHA256 06effc4c15d371b5c40a84995a7bae75324b690af9fbe2e8980f8c0e0901bf45
MD5 910dd666c83efd3496f21f9f211cdc1f
SHA1 77cd736ee1697beda0ac65da24455ec566ba7440
SHA512 467d3b4d45a41b90c8e29c8c3d46ddfbdee9875606cd1c1b7652c2c7e26d60fedac54b24b75def125d450d8e811c75974260ba48a79496d2bdaf17d674eddb47
SSDEEP 24576:Lutr5OUF7zfbMEsJiZp8uSOBpik+Qijrcq0y0JL4SprofsCghjmxQ:LuXfbMvGei9yjrcq0y0JL4ggghjv
MD5 SHA1 SHA512 SSDEEP

Submit Download

[email protected]:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\7zO4F49B96A\[email protected]:Zone.Identifier
Size 218B
SHA256 24a2823029ec46824b2538bca5ccb92ec44d50ca91621fbe6b4c21107e77a4a1
MD5 b6906b0248b54857d318cbe72eb7b1ad
SHA1 951ea605ce153a005a4209fb098f87e068b2b0cc
SHA512 b74f3feb284eaa26a2238eca2a8762709500f25dbbbdcd459041c23bc50c833aefb1ce90d87873c1d40ec38589055fcd150fbcda578699101f3ee490c157a52b
MD5 SHA1 SHA512

Submit Download

avpc2009.exe.lnk

Path C:\Users\Admin\Desktop\avpc2009.exe.lnk
Size 1KB
SHA256 52dfc84f9fa3a616983b57675999098af0f3f7018523bd6ee78513e298fce8e1
MD5 21f80814310a7d8acb8445390f22b788
SHA1 56123ea660435ef20b668db5476928489c59243c
SHA512 018168a05dfa72495628c816d5ccf39b825b4b7d5ccec227cf2c86bae85e547da862a7d99323393afe725e32fd86629217807893cae883eefed734a3a6165c29
MD5 SHA1 SHA512

Submit Download

AnViPC2009.zip

Path C:\Users\Admin\Downloads\AnViPC2009.zip
Size 1.1MB
SHA256 45b75a116aa3b07f90a7c2d9a83c2cde524797df88bb5e20f9dc1e74d8527861
MD5 9a38c29ff9e12ba2892381eb51c79934
SHA1 76fcf6bcaac32f624fa0154a9177e44469b5886a
SHA512 c26d8c252d6f18a2ae4419bbfe27099862a625cbc40d8f104fa20cb361da112ebe6a17935ac3613c24b58f9c291d2219e55f59e0fa40b81f92fccf190115e734
SSDEEP 24576:lKTP6/tHWoQQRakFbfVKqycdGiazlXVyQ8MiSIxjlTGPje9V4iuquGGspoLA:lK4WDQRaklfVKJcd7MXVlPiZlTejkV42
MD5 SHA1 SHA512 SSDEEP

Submit Download

AnViPC2009.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\AnViPC2009.zip:Zone.Identifier
Size 119B
SHA256 584f67b16f471e8876ec7a9ab8974ffccc008263906654ddca1db31d02c09b49
MD5 f30fb7790599e17db6b9d683ecc3f3f7
SHA1 578e7579bed0fafa460d613eb0bbd3f3cec32487
SHA512 f9b1a6a066c803f7679348b35a6668c3988fdea4adc9aef5bf5e563ddb4599865af113245448eba867f807cd86eab5c60c32f611345248255c5e78f4b31e7680
MD5 SHA1 SHA512

Submit Download

memory/948-602-0x000000006FDC0000-0x000000006FDCE000-memory.dmp

Download

memory/948-489-0x0000000068440000-0x0000000068457000-memory.dmp

Download

memory/948-488-0x000000006FDC0000-0x000000006FDCE000-memory.dmp

Download

memory/1936-712-0x00000260C5D50000-0x00000260C5D51000-memory.dmp

Download

memory/1936-710-0x00000260C5D50000-0x00000260C5D51000-memory.dmp

Download

memory/1936-711-0x00000260C5D50000-0x00000260C5D51000-memory.dmp

Download

memory/1936-716-0x00000260C5D50000-0x00000260C5D51000-memory.dmp

Download

memory/1936-722-0x00000260C5D50000-0x00000260C5D51000-memory.dmp

Download

memory/1936-721-0x00000260C5D50000-0x00000260C5D51000-memory.dmp

Download

memory/1936-720-0x00000260C5D50000-0x00000260C5D51000-memory.dmp

Download

memory/1936-719-0x00000260C5D50000-0x00000260C5D51000-memory.dmp

Download

memory/1936-718-0x00000260C5D50000-0x00000260C5D51000-memory.dmp

Download

memory/1936-717-0x00000260C5D50000-0x00000260C5D51000-memory.dmp

Download