xworm | hxxps://cdn[.]discordapp[.]com/attachments/1280961985621790772/1280962517090304070/nursultan[.]rar?ex=66d9fccf&is=66d8ab4f&hm=7f888e6d85fb771427a7aa2a809fb0685f0328ca2b38d856c6e7da6acd229fdb&

Analysis

max time kernel
172s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1280961985621790772/1280962517090304070/nursultan.rar?ex=66d9fccf&is=66d8ab4f&hm=7f888e6d85fb771427a7aa2a809fb0685f0328ca2b38d856c6e7da6acd229fdb&

Score

10^/10

xworm discovery persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:6489

Mutex

stLsyA1OkjzrNwqr

Attributes

Install_directory
%Userprofile%
install_file
svchost.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000235a1-725.dat	family_xworm
behavioral1/memory/3108-733-0x0000000000B80000-0x0000000000BE8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	7zFM.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
4336	7z2408-x64.exe
2240	7zFM.exe
3108	nursultan.exe

Loads dropped DLL 3 IoCs

pid	Process
3360	Process not Found
3360	Process not Found
2240	7zFM.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\svchost.exe"	nursultan.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2408-x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133699493849455034"	chrome.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{766E1B5C-3A78-474B-8CBD-CF17E6756627}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
2240	7zFM.exe
2240	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4336	7z2408-x64.exe
4340	OpenWith.exe
4340	OpenWith.exe
4340	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 4480	3044	chrome.exe	83
PID 3044 wrote to memory of 4480	3044	chrome.exe	83
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 4832	3044	chrome.exe	84
PID 3044 wrote to memory of 3864	3044	chrome.exe	85
PID 3044 wrote to memory of 3864	3044	chrome.exe	85
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86
PID 3044 wrote to memory of 3348	3044	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1280961985621790772/1280962517090304070/nursultan.rar?ex=66d9fccf&is=66d8ab4f&hm=7f888e6d85fb771427a7aa2a809fb0685f0328ca2b38d856c6e7da6acd229fdb&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9f57ccc40,0x7ff9f57ccc4c,0x7ff9f57ccc58
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1960,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4700,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4972,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5000,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5188,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3348,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3204,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3420,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3380,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3992,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5540,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=724,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5804,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5296,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3996
- C:\Users\Admin\Downloads\7z2408-x64.exe
  "C:\Users\Admin\Downloads\7z2408-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5800,i,10855335553553828691,4145217236178532449,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1376

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5092

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\nursultan.rar"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2240
- C:\Users\Admin\AppData\Local\Temp\7zO0C8E6849\nursultan.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0C8E6849\nursultan.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
d346530e648e15887ae88ea34c82efc9

SHA1
5644d95910852e50a4b42375bddfef05f6b3490f

SHA256
f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

SHA512
62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
963KB

MD5
004d7851f74f86704152ecaaa147f0ce

SHA1
45a9765c26eb0b1372cb711120d90b5f111123b3

SHA256
028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be

SHA512
16ebda34803977a324f5592f947b32f5bb2362dd520dc2e97088d12729024498ddfa6800694d37f2e6e5c6fc8d4c6f603414f0c033df9288efc66a2c39b5ec29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
d4607a79a3691bd457fe17567d4f61d3

SHA1
37df6decb2eca00f2d1dbd6bf7beeea3c187a978

SHA256
5eb75d762229c704a2987a307af29f792d84f27596fcc4c6ae3cc5c885da716e

SHA512
23433fb21a416f183c95bbb55e532d166826fbe7caa2fd8dc5e1ace712c3ea97ba222dace0eee6d64085216f7ecc1941d440909efef1e18f4120bdfd3ee10feb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
277ed0a4b9f38f23383b4b46807020ec

SHA1
a590d753a1630781441c3f373d7539d2d0b080a8

SHA256
7ddf72fe8f0c6f63eabdd58137026f47980ce83971f5b9e8297265d3f16bc277

SHA512
5a49f09d892c69cc1984ddb079a430e0cf80a6d26f25f15456cb87626c66b0777c818bc620884b940e919a15cefee215f301108bda1ba9db380b8368bb1b6b52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9ff26073d829caf00b51cab87b42553f

SHA1
5019f15ace544e45d41dd53578d178aae95184f9

SHA256
3ecf74529aa85cfe1c3b6e6a8c0fa660a441edcb12b5a656e086a68bd4492f50

SHA512
0be9623ac2777d15d011a7b9839a602e797897b991070e8447e0e0c6bfe5c090de9a1c6f9ff47306dca1cfcf57754acb91bf5d2eb529e0f9f201a8cda57e396c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
ac1b59fefab76dc543118e67fc4faff1

SHA1
626bbceecec54c65cb1ee88d417af3420586835b

SHA256
03809320b427853e2d62a43b7faa048ee93994cef842eab5d4158fe5b3521a32

SHA512
01b6f4303cf06840b260720b6d60b2ab63a30f05ad1a95d3b6a92fbf5e57c3955e08e338f57b1bdd5e74a2373d8654f0e8165e1179328e0f0b12310f1a499b64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
33a72de64bacfa8e5add9af7624aaef2

SHA1
d6f5b56da1885e22019a2746db978da6f8f100f2

SHA256
c024349bd9cc47ee2258c6cba70804dfda24f7e06cf7132344330c0d478d9e09

SHA512
33af039e954ece5d0448e60f8fe10785289dde0d0138ac05950bb5d84ed29753b743ce65eefe2877bcd25d5d6cee4e9325423355390947a84aa9ae8366c03b9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
7c8228df6db6e8dcdd1de52c9f705b72

SHA1
6859ddac6d53bc9ad169b877367317870125a968

SHA256
fc1cb736cb2d73940b3c229cb91ff91d875f9adb910192ced95319f1a56f305d

SHA512
4122b00584652d1b1fc8a13c92453788ea3604b283cdfb4c737f17bcd591f38cd6863e752f0f117bd29f9ed9c54004dfc7be3cebe49df4df97d8a2b3c7b5c595

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a8e3d9c5c6ff39a128b26ec9d8f58fca

SHA1
e5ed4970e65d0347ab5a671cc25f492ebc242911

SHA256
c43b2ecc6ca36e6999c1b6a325369323a9f53f9c083b3ad39aa3f3955a63f673

SHA512
43b4cb214b5444c0ba6d654b6363135cc68cc7dd2a1a2271f8fd2f4dcbc4fabf45dfdecc1a1ab73ad5b22f5c68a18f8a23be27f8150a5c5bbc72668b5b778212

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
ff8fbd47f3a47128e5cabd55f34253dd

SHA1
91a8adf103d68a02bfacb3032d55828260b2732a

SHA256
01eb32e9d1f075fb1e0bb499bf9e1e2650f7455b9f7a18b28896a3661b1aa28e

SHA512
5413a96c3657250e1b805b97f90d7b3add633d5c179266a354113e0a6a511b3b5a23e8f3666daee995306d44755485caa14aa1a9e92fc25bec5f5471b519e545

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1015B

MD5
a2c1070a9ac7489a01fefefc868e1ef7

SHA1
e46f06ee72d3c83cd064ea00bdf2af13db40681d

SHA256
4a3be82c2a20371a5ec996091cf107de69878dcded5d34ab6542c997d751e596

SHA512
d1c8a298a44160efeb5232a4b40fb33dc1a4ef706a51cdbc1bd6b10cc71111ca487a5dc474326f968db754f10c1760c01ee7699635626f8cf9a50a8ad2db12a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1015B

MD5
d906abbbfef3365c799201889d4c846b

SHA1
19510ae7645b9421fcc9e3eba0e8c08e1628d6c0

SHA256
ea56fafe787753e1f0f088a7effa9e604a015dd4461db8d9574247bd8c36e84d

SHA512
bde0d9c1dc7480e0009d4b6f45b20329eb48b7816ac089df51093cca59b4f8405b2532e7f15e137833d0e81f2a83fe69c38f62bda478d65c01ab7905e15bc823

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c554fd98834047d4d4dbbaf59c371aab

SHA1
89994952efb770fda909ecdd244a89f5c8dc6562

SHA256
b4f632a853168fb6070d93db87f7fc098cfe412c457bc955a3640cd535d4dcfb

SHA512
d3833c854cff334d9a2a57cc5b80bdc91ccb179458c4e7d77f2f2a9e69ec436864c9177853d363855126d17e2fb2d1146da335d73be6eebd7c70f74711a9a48f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9c8cf510f8ab3946ef3c8fc51942ca38

SHA1
269dfb4995a1536b2209d041bf35c0a254cc6ed2

SHA256
20ac51dcd63c5ec2f196aff561a95a28f7a297207c9e42bb0772663349fb10b0

SHA512
d623cd8c977efce862ff11ab6b4a03b3996acfd2238d170b5d121e850bd0b0fdbe66b9ba5cc19f0e84e3773d128532a78feea5ab1488abc3251278f7caaf3933

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ea711ced294e2d4e004c5135d9d0a53d

SHA1
dcdc79a6011143c5c6c7d6a64e9cd65a1417965d

SHA256
8eac3bb9188fd0477623f26ffd396e2791d81fb8c05a90ad3c93967f0c4792ad

SHA512
64fda9509b788eab383d58d224393064824cd0aa9e655c67eca2c3ac1cfccb61ea76ebe256a4102331c8b989a4510c5afd9c3ac8dcdc9a69f4ec9b5cabd923ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b0aa86ff00a2cad7de6ae33710cae4a3

SHA1
52c8f51a4538dc82c0b98d5aa9feadc9fd6423a2

SHA256
8e501c5b0ee02a2af4127ceb48a744de765c9602d2b2c99feec103ab79a5a914

SHA512
08fc1a4c64053b9cf2e068ec8d9c98a7581b1756f418c5ca7a758ff49de4a5d37172a7e7bfdb903926431567bda17ebcc3ca26a340b5b46e77c3a36d8437df55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b22e48901bdb0a701657a4494a61e7de

SHA1
66b7b752d60aeae5a20b458fce590718249f2217

SHA256
144dd06928d179a88a452863a455087007a5feda5d16b9e9fb2a699b9eb15ccd

SHA512
69859f9153c2586596aaeef863e6b9cb43684c306d2f8c392e4cc99b481cdca658d193eed0011f0fc86c6d6d53a53d8a50120f650728cdda134cd7344f9c19a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
45a080b1d7ff07b08a422a3f9d388612

SHA1
8561ba882806846346aeb676897f6a9dfe882a17

SHA256
b99f13e26508fb9fecfc932a1f03f2bc53bf6ccf440a82bb0fbf9e5d3dcdacb7

SHA512
2c2463b32fe0493123a3b8f9100150f10d0ea293bb888acd22b8f7db417cba948337c8674825898042dfd461c6248a5e7a6ce42688dc7254f8f975e34d1ca981

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
679c897ff478de1a4bdbb9befbb56263

SHA1
36175e87f73260ddfcd6f34ebec33d51832b25a7

SHA256
e08df88a6fe92ff1b01e4bcc27c9414bb0177ecbf72afcdebc7bf6e059e58747

SHA512
fa0ca3503ca945617819dce5690656409b59b5d28840e44ddd26a466cbef8fef868cc043398594af20e11705237b77f60d4fcc94ec207d56c71d11b459f6ef05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
36288d624b6384418db603d3c5eaf29d

SHA1
4009a3b7c9eb81bd08480ba77c31a9d4d21169df

SHA256
bfa0dab47460e51e7af4ed51568639ce4bc37d7fe2696b0a6203b7391f2a66a8

SHA512
f9d7473a5053e90552239edc10c4e691ad8f9d03df9842e76279e3d9fa0de2d6f8a27435260189fb9094274f080cf67a7ed727f143925909cf93cdf697bf136c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6a02eaf7882a531cd4f47a99ebb78b50

SHA1
cc5c26cedd84a09107e133ef88fbb38b00c7faec

SHA256
a4655bdac399a81ec85d0ad60ffd54f924de08fedf2b17651cb3c9fba9a2d77a

SHA512
7ef82680474fabfea727c3c7cbcf91a3e81718b54ab21896b344d4a1f01378ad89a50b021c917290dfb64189d72fac7f9e022e7ac72808eb6b3d501b135d2678

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ec25d576f67446cd28b88a3fb75e4433

SHA1
9eecc52e5cd30d7e58fd16cf35f4555de7c70976

SHA256
a62fc4f34b9f120169f4e22b4bb6c14e68a3a2ebfd861e039e37b62d65845af2

SHA512
7ff8a24902af122caea47e92c1517ff46257ed7c51ec1b605ff652a383d14df5fa6f5e85c843f9f3ed01e150a3473cf4f1ebf2892413cb7dc1ef0c54e79750f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
8ddb7e45742129246721b2431f1b74ae

SHA1
18a8c423c2f062aa1aba69325c793ee92d0c1dc2

SHA256
7276969ec2af7c1e4975ba808aa279d3bf17ce7893905a369408de441788b7cb

SHA512
f8d448e73bbacf4876f8062c213bcdcdbe27285ae872edf0678c79b055ce2c1a57bb73be21b66c5becb19559ae4337d0661b4230c344a0689086e3b29f8cb526

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
1155952f36c45d66b0f25b699876e6cb

SHA1
f928da1d87eb401d2864803c4ed64c0667632af0

SHA256
7efdf4e09f16bf618f721d274b906f151d78c9b26c0141da59e79a523a8e3ff3

SHA512
bbfac00c69252e858efecbe4853fb06191d581d7110a9875e9040ead0e878d5ab404233d45e8cc39da92838a488942b6125a5c489cee30a2295e02ee2267f29b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
de7eecfb609f1efdd037eea1e5681370

SHA1
860f26459a5eba3a19cc696141e3be10d6c8112d

SHA256
5e4a22346d8f26074052684a4ccd291718405fdfcd20b0493fba635f8ffa54fe

SHA512
c2e91a9725c8f71fc2e78a623354182574504bc3a501599d748b59db8d64f656e69252667c32d70e62776e45a153d08c371058f29854da95a5087233779873e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO0C8E6849\nursultan.exe

Filesize
395KB

MD5
4d4208a9297322f4fbde5686285227dd

SHA1
268ce148edbea3e2101bb5c8b3d80e281650c4c5

SHA256
6e68fce6b9b38f1994e7975aa7a725b8187e8fede690ccc655e12caf14d7b65c

SHA512
a2c657244042015f35747a4b8c6cd8431b4c2f0ed0eb7430acad0ac00076881c4e150111324859ad49d9f7a0dc67327853fbbc03620456040793cfd19a6737bc

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 108449.crdownload

Filesize
1.5MB

MD5
0330d0bd7341a9afe5b6d161b1ff4aa1

SHA1
86918e72f2e43c9c664c246e62b41452d662fbf3

SHA256
67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

SHA512
850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

Download Submit
C:\Users\Admin\Downloads\nursultan.rar.crdownload

Filesize
123KB

MD5
c08e1847c67f466ad422f64911116f3c

SHA1
66be9e16ed8ab206cbd43b563f8cfd54c984d776

SHA256
1d694c79a09a43e3c6471145276b31b51b134586089b12da93d72ad4e72b7046

SHA512
a01bf78c604d276613b8a443128d99524beb896885b342cddad7fcd3c4e8b1cafd818cbf501ba9833ffe1321a4e2e40d05bf484aba406ec7c4fd9ba8ef3d0bab

Download Submit
memory/3108-733-0x0000000000B80000-0x0000000000BE8000-memory.dmp

Filesize
416KB

Download