latentbot | 1355780e4fa5680c503fc33814110d4ceeaf38e374fa60d02903eaadfc2fafd8

Analysis

max time kernel
300s
max time network
304s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows
submitted
03-12-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

archivo3.vbs
Size

24KB
MD5

71fece3e0461df9f8fc019c926b66d1e
SHA1

e6a07dd51d0d781bcfc921d43f9fc39051fde4d6
SHA256

1355780e4fa5680c503fc33814110d4ceeaf38e374fa60d02903eaadfc2fafd8
SHA512

7694e1cb3f4b72192cb721a01fac378e8eaa8d1f03dd293f5ffa27ca52967e10ede4734036050a3c84831145eb6c643129eea94796aa3f83bca9d2b2db112c85
SSDEEP

768:vXLWq6+cwbmAQtplUkBP4zKq5cDBMqAkROs:iq6NwKAmn9N4zKq5cJ

Score

10^/10

latentbot collection discovery trojan

Malware Config

Extracted

Family

latentbot

wretched33kinder.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Detected Nirsoft tools 16 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral1/memory/1620-121-0x0000000000400000-0x0000000000A8B000-memory.dmp	Nirsoft
behavioral1/memory/1620-123-0x0000000000400000-0x0000000000A8B000-memory.dmp	Nirsoft
behavioral1/memory/1620-122-0x0000000000400000-0x0000000000A8B000-memory.dmp	Nirsoft
behavioral1/memory/1620-124-0x0000000000400000-0x0000000000A8B000-memory.dmp	Nirsoft
behavioral1/memory/1620-127-0x0000000000400000-0x0000000000A8B000-memory.dmp	Nirsoft
behavioral1/memory/1620-415-0x0000000000400000-0x0000000000A8B000-memory.dmp	Nirsoft
behavioral1/memory/1248-704-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/3852-703-0x0000000000400000-0x0000000000A8B000-memory.dmp	Nirsoft
behavioral1/memory/1248-705-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/3852-731-0x0000000000400000-0x0000000000A8B000-memory.dmp	Nirsoft
behavioral1/memory/3420-753-0x0000000000400000-0x000000000047C000-memory.dmp	Nirsoft
behavioral1/memory/3420-754-0x0000000000400000-0x000000000047C000-memory.dmp	Nirsoft
behavioral1/memory/2736-752-0x0000000000400000-0x0000000000A8B000-memory.dmp	Nirsoft
behavioral1/memory/2736-762-0x0000000000400000-0x0000000000A8B000-memory.dmp	Nirsoft
behavioral1/memory/2736-763-0x0000000000400000-0x0000000000A8B000-memory.dmp	Nirsoft
behavioral1/memory/2736-777-0x0000000000400000-0x0000000000A8B000-memory.dmp	Nirsoft

NirSoft MailPassView 14 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1620-121-0x0000000000400000-0x0000000000A8B000-memory.dmp	MailPassView
behavioral1/memory/1620-123-0x0000000000400000-0x0000000000A8B000-memory.dmp	MailPassView
behavioral1/memory/1620-122-0x0000000000400000-0x0000000000A8B000-memory.dmp	MailPassView
behavioral1/memory/1620-124-0x0000000000400000-0x0000000000A8B000-memory.dmp	MailPassView
behavioral1/memory/1620-127-0x0000000000400000-0x0000000000A8B000-memory.dmp	MailPassView
behavioral1/memory/1620-415-0x0000000000400000-0x0000000000A8B000-memory.dmp	MailPassView
behavioral1/memory/1248-704-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral1/memory/3852-703-0x0000000000400000-0x0000000000A8B000-memory.dmp	MailPassView
behavioral1/memory/1248-705-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral1/memory/3852-731-0x0000000000400000-0x0000000000A8B000-memory.dmp	MailPassView
behavioral1/memory/2736-752-0x0000000000400000-0x0000000000A8B000-memory.dmp	MailPassView
behavioral1/memory/2736-762-0x0000000000400000-0x0000000000A8B000-memory.dmp	MailPassView
behavioral1/memory/2736-763-0x0000000000400000-0x0000000000A8B000-memory.dmp	MailPassView
behavioral1/memory/2736-777-0x0000000000400000-0x0000000000A8B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 14 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1620-121-0x0000000000400000-0x0000000000A8B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1620-123-0x0000000000400000-0x0000000000A8B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1620-122-0x0000000000400000-0x0000000000A8B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1620-124-0x0000000000400000-0x0000000000A8B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1620-127-0x0000000000400000-0x0000000000A8B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1620-415-0x0000000000400000-0x0000000000A8B000-memory.dmp	WebBrowserPassView
behavioral1/memory/3852-703-0x0000000000400000-0x0000000000A8B000-memory.dmp	WebBrowserPassView
behavioral1/memory/3852-731-0x0000000000400000-0x0000000000A8B000-memory.dmp	WebBrowserPassView
behavioral1/memory/3420-753-0x0000000000400000-0x000000000047C000-memory.dmp	WebBrowserPassView
behavioral1/memory/3420-754-0x0000000000400000-0x000000000047C000-memory.dmp	WebBrowserPassView
behavioral1/memory/2736-752-0x0000000000400000-0x0000000000A8B000-memory.dmp	WebBrowserPassView
behavioral1/memory/2736-762-0x0000000000400000-0x0000000000A8B000-memory.dmp	WebBrowserPassView
behavioral1/memory/2736-763-0x0000000000400000-0x0000000000A8B000-memory.dmp	WebBrowserPassView
behavioral1/memory/2736-777-0x0000000000400000-0x0000000000A8B000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 3 IoCs

Processes:

WScript.exe

flow	pid	Process
6	3132	WScript.exe
8	3132	WScript.exe
13	3132	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 1 IoCs

Processes:

attrib.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9iy.lnk	attrib.exe

Executes dropped EXE 1 IoCs

Processes:

uoo3758yi9ai.exe

pid	Process
3688	uoo3758yi9ai.exe

Loads dropped DLL 2 IoCs

Processes:

attrib.exe

pid	Process
2736	attrib.exe
2736	attrib.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

attrib.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	attrib.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

uoo3758yi9ai.exeattrib.exeattrib.exeattrib.exe

description	pid	Process	procid_target
PID 3688 set thread context of 1620	3688	uoo3758yi9ai.exe	92
PID 1620 set thread context of 3852	1620	attrib.exe	120
PID 1620 set thread context of 2736	1620	attrib.exe	126
PID 3852 set thread context of 1248	3852	attrib.exe	132
PID 2736 set thread context of 3420	2736	attrib.exe	133

Drops file in Windows directory 2 IoCs

Processes:

chrome.exechrome.exe

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\INF\display.PNF	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

attrib.exeuoo3758yi9ai.exeattrib.exeattrib.exeattrib.exeattrib.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uoo3758yi9ai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133777094713743089"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3495501434-311648039-2993076821-1000\{92B5871A-6338-4DD4-B929-48F7C129BB75}	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

chrome.exeattrib.exeattrib.exechrome.exe

pid	Process
3884	chrome.exe
3884	chrome.exe
3420	attrib.exe
3420	attrib.exe
3420	attrib.exe
3420	attrib.exe
2736	attrib.exe
2736	attrib.exe
2736	attrib.exe
2736	attrib.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

chrome.exe

pid	Process
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	Process
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

WScript.exeuoo3758yi9ai.exechrome.exe

pid	Process
3132	WScript.exe
3132	WScript.exe
3132	WScript.exe
3688	uoo3758yi9ai.exe
3688	uoo3758yi9ai.exe
3688	uoo3758yi9ai.exe
3688	uoo3758yi9ai.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe

Suspicious use of SendNotifyMessage 28 IoCs

Processes:

uoo3758yi9ai.exechrome.exe

pid	Process
3688	uoo3758yi9ai.exe
3688	uoo3758yi9ai.exe
3688	uoo3758yi9ai.exe
3688	uoo3758yi9ai.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

attrib.exe

pid	Process
1620	attrib.exe
1620	attrib.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WScript.exeuoo3758yi9ai.exechrome.exe

description	pid	Process	procid_target
PID 3132 wrote to memory of 3688	3132	WScript.exe	88
PID 3132 wrote to memory of 3688	3132	WScript.exe	88
PID 3132 wrote to memory of 3688	3132	WScript.exe	88
PID 3688 wrote to memory of 3644	3688	uoo3758yi9ai.exe	90
PID 3688 wrote to memory of 3644	3688	uoo3758yi9ai.exe	90
PID 3688 wrote to memory of 3644	3688	uoo3758yi9ai.exe	90
PID 3688 wrote to memory of 3644	3688	uoo3758yi9ai.exe	90
PID 3688 wrote to memory of 3064	3688	uoo3758yi9ai.exe	91
PID 3688 wrote to memory of 3064	3688	uoo3758yi9ai.exe	91
PID 3688 wrote to memory of 3064	3688	uoo3758yi9ai.exe	91
PID 3688 wrote to memory of 3064	3688	uoo3758yi9ai.exe	91
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3688 wrote to memory of 1620	3688	uoo3758yi9ai.exe	92
PID 3884 wrote to memory of 1120	3884	chrome.exe	96
PID 3884 wrote to memory of 1120	3884	chrome.exe	96
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 3640	3884	chrome.exe	97
PID 3884 wrote to memory of 4384	3884	chrome.exe	98
PID 3884 wrote to memory of 4384	3884	chrome.exe	98
PID 3884 wrote to memory of 4580	3884	chrome.exe	99
PID 3884 wrote to memory of 4580	3884	chrome.exe	99
PID 3884 wrote to memory of 4580	3884	chrome.exe	99
PID 3884 wrote to memory of 4580	3884	chrome.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 13 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	Process
904	attrib.exe
3852	attrib.exe
3620	attrib.exe
1248	attrib.exe
3644	attrib.exe
1620	attrib.exe
3924	attrib.exe
2912	attrib.exe
2736	attrib.exe
3420	attrib.exe
3064	attrib.exe
4512	attrib.exe
4212	attrib.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\archivo3.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3132
- C:\ht21b5x7\uoo3758yi9ai.exe
  "C:\ht21b5x7\uoo3758yi9ai.exe" uoo3758yi9
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3688
- - \??\c:\windows\SysWOW64\attrib.exe
    "c:/windows/SysWOW64/attrib.exe"
    3⤵
    - Views/modifies file attributes
    PID:3644
- - \??\c:\windows\SysWOW64\attrib.exe
    "c:/windows/SysWOW64/attrib.exe"
    3⤵
    - Views/modifies file attributes
    PID:3064
- - \??\c:\windows\SysWOW64\attrib.exe
    "c:/windows/SysWOW64/attrib.exe"
    3⤵
    - Drops startup file
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Views/modifies file attributes
    PID:1620
  - - \??\c:\windows\SysWOW64\attrib.exe
      c:\windows\SysWOW64\attrib.exe uoo3758yi9 ##1
      4⤵
      Views/modifies file attributes
      PID:3924
  - - \??\c:\windows\SysWOW64\attrib.exe
      c:\windows\SysWOW64\attrib.exe uoo3758yi9 ##1
      4⤵
      Views/modifies file attributes
      PID:4512
  - - \??\c:\windows\SysWOW64\attrib.exe
      c:\windows\SysWOW64\attrib.exe uoo3758yi9 ##1
      4⤵
      Views/modifies file attributes
      PID:904
  - - \??\c:\windows\SysWOW64\attrib.exe
      c:\windows\SysWOW64\attrib.exe uoo3758yi9 ##1
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3852
    - - \??\c:\windows\SysWOW64\attrib.exe
        
        "c:\windows\SysWOW64\attrib.exe" /stext "WWy1"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1248
  - - \??\c:\windows\SysWOW64\attrib.exe
      c:\windows\SysWOW64\attrib.exe uoo3758yi9 ##3
      4⤵
      Views/modifies file attributes
      PID:4212
  - - \??\c:\windows\SysWOW64\attrib.exe
      c:\windows\SysWOW64\attrib.exe uoo3758yi9 ##3
      4⤵
      Views/modifies file attributes
      PID:3620
  - - \??\c:\windows\SysWOW64\attrib.exe
      c:\windows\SysWOW64\attrib.exe uoo3758yi9 ##3
      4⤵
      Views/modifies file attributes
      PID:2912
  - - \??\c:\windows\SysWOW64\attrib.exe
      c:\windows\SysWOW64\attrib.exe uoo3758yi9 ##3
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Views/modifies file attributes
      PID:2736
    - - \??\c:\windows\SysWOW64\attrib.exe
        
        "c:\windows\SysWOW64\attrib.exe" /stext "WWy0"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Views/modifies file attributes
        
        PID:3420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff935c3cc40,0x7ff935c3cc4c,0x7ff935c3cc58
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3732,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4880,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5460,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4528,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5420,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5436,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3340,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5520,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3384,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4748,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4688,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5388,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5680,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5728,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=4376,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=3292,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6064,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=6072,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4860,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5968,i,15395787247817914038,13974603650278925561,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4036

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
e7aabca3d7754b4302feb7450d617621

SHA1
138910019559be4c4156237edb8007e10082537f

SHA256
50673888b79f6482e13765ea6dada9cb179ed2ee75005620598af1c59f24e06c

SHA512
e9b72418ca13ffa9a1fa4f5ea1776f87751e90839183ea915424ee8378e984c4552e6c2060bc56a43a131902a1f4a487e6e372421b1a5b7fb36e87221b167bab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
95eb318d06f172f53ce59a3fb4b22af7

SHA1
0d29eee57992fedba7063ad2ef5545c7b4c93b9e

SHA256
94be8492305dfe034e23c6674b6a42adb944609389156345bfbc849de5228e1c

SHA512
f2173af6bb05a3e4af039f2bb4c05e34491fc9632543554ab203f0b621586625b1f882eac7b8fdc86d2eab06ccbca22f06a73ed82f8076e8ec427cafcfad7c80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
0f7aefcae011bcd72922c68d7a23311c

SHA1
f4f0ea816bd936c7e20dc9565ce071e92208e83c

SHA256
079db86cb0e6e55e15c5faa40af71b8518e808e6fe9447b587f9f42c84062acd

SHA512
cbb98f332fbcfdc3484033c8c0416cca5d45344410611d1e181ed48d730537457ddc269f8539af627707385482b379e9f3dbc21deb98576a895c5c6d10b79012

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
181dc0d81162f7fe82bdb412ce32c4c2

SHA1
abaf11259ebffc9a47c761335a73bcf72bda8334

SHA256
408676d18833d0e8a2c8fc80d53178f02f132b9dc814dfc6b51cafabdb29e327

SHA512
f49d6b58b51ca87bcc3eac7f9e6e2c0c770ae35886c681c215e1b53158a9694a158ce464084287f82728d754f7f9b6f0c669edbc32ece8f1cb6aff583c90b6b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
8ff62d31cfe34ec4ae3022339d2b3a83

SHA1
71cf6cfc3cab2049f9dc01bdd56623cc0bac91a3

SHA256
9cc0ad7668291e1c50d236b3329f7f5e4bb00bce067bf64c692becc603b906a2

SHA512
1ff35afbc159f5fb583e71f809db0b93f5703317d275e639acc83a202e3ecf94aae8b61215e1badd2d2d29ee2ba00e42de73bde670fddaa4ecf6cf2d5484e2a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
e6bef5f982b883a96573838282c37c56

SHA1
6b395918a973a226197f460e0db506df3a621113

SHA256
19d51d8620ae14d504e2da50d4bb920f019db6ff7fd4d9cb576f44e88a7ccea5

SHA512
0612472007bfd85e3b5eb1fea287154f3a6405dbeb9d0b8da118918d88d7b8fa6fe161a91b9db98097813c939f85231e18d49b599b7b07693524207ff9d48592

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
03820b6937a72f751f6e7c76e247bf74

SHA1
6ea262b6d58426bc61f1758e962fb992f33356d6

SHA256
19ff87e867d0b1d67026008da721611b1c61c1bfa9b59e85dd8525c0cd32e74e

SHA512
1616d419a223c585372b9187260aa7269d5a6d9f550e0aa88f4711748aab74e1509f5010206ce0417771f1b08e12b555e1304828fbc872757d2b26db1ef37519

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d23ba0da476e4d46aa574cc38816bbfe

SHA1
33759c962c5cd7351114e0eb9e215cb6be879d4b

SHA256
00cbf38d183acf306bb6ffee3b0b8f50092ee1f6b7fdd39a04876aff7864c32c

SHA512
e65f7e1f89ee7e05fd165ed200e99bfc9416dedd58413be25d9d7abace9ce348ceb7a11c23f24c28b3064d0ac0718037b1589ff8430795bf521656973f1134d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
abf209f2e00ab5e3578bdd2355b32612

SHA1
e36f11fbf281fb7a77f97f880489fb5af9734833

SHA256
b6f740412f14105e717cba32f5880d98f717f260b2a402ebe7b7150d4e170bda

SHA512
7f9c59e03b98eb340fd83cb7ed456231cc91e3fb187e935582365bffec7669fabf6b5e06ae9e0fbcbdd51713b193e90364bab483f60785fbefb6d84a18ceeeb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8690ff20ab6974517d9aba48062f6df1

SHA1
6394ce0ddb0e46fa0bcd49f7aaf01730f70b4915

SHA256
21ec48b588a21f353be9ec95d9757d6def141e0eec6555eec45ce84ec60f8ce0

SHA512
497096bdf0032f7eacaf6db90cfba0f6ca54883685b81b9f814604b0bbabdc70ea9088d5a52be7ef5f7d28b2d3d21a828c67b1a37d4f8dd1585d7ba424b16510

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0c799eb379199c45111ea74b1de2ed60

SHA1
c044d533aa63bd6e995fd890f5a294cfea073759

SHA256
d9abe83dcfe7df3f2bb9f8d771d2bb76551698d98341e582887f7e90fc12b701

SHA512
3381b72375ca3e46547f3498d10e09fabd43c2d33b52e56885c76539be568318dcb862c31205794ed0cdff5d390bf21e783acaaae1f6a1d17ac35eb866fd8dee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
547d514033231c0f780c62bfd4f53d4d

SHA1
6f051d76f720e0ddd2b78a229dcc84fc8199cf74

SHA256
88d2fcff4279e9cd3aafee554952262de0e6d454cdc6a60f2eb210776494005f

SHA512
49d962dab145a84624f826743a2b5a26517443fdc6c8d66facb4c2c9f01a8fa9259a5c7d880dda81dbc0cafec605686dff832bdd250ee9a0137f13fdd403d266

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ab1a0b76d8dd915ebecdf82cb0a520df

SHA1
7c79727e47a726265bac9aee8f246626652dafb8

SHA256
49cfad5a6a9c0b409b391c7db8606148ade948511b3f44779ea4e86d4582e74c

SHA512
7a095591d392fc5d9bdb391d07f86f5ed5e1c42b7226fdad22060f53c4fb3231bc49e8cb2729a1f6ae48e62dd4555b24c1f093821eb0a5c9b6ea4ba0b873ed81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7525db6753793409d93449522be29d1f

SHA1
d812032712536de51176ab597cd5dfae43f91c26

SHA256
22ecefac3d5d19296c3a6afed0521f359bbd205a6c1553f3fbd6dd2c3b34641e

SHA512
d53ceebabe4bd48d9a08e494c5e0415d782b004a3cac94842154cc68a721a763bc5a3d74bde439a767e77a43cef2b1660640505cbf6767266d1738c6fd5b2570

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
782a89158e53dcf977fdc9655f14e75e

SHA1
7196d50f31b9349919ad3b8c5ebc90d553c10b6d

SHA256
13cdf89e3dd8dacd87ee26bd1af80c86d30d4517bdcaa69b5cc9436ac8020c24

SHA512
28a30ee19c87806c83d9c76d0b7762608d91d34dfb9215e0285de438381abf188ff6b53fc6aad3c7501c384cdfccd49e6aacb89e6b1eb812bb0425049ec20d40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0785c0129af268ce9794b69c7b2e88ec

SHA1
95f5a97d6daead62cd1b34b137b6d8defd70ba7e

SHA256
9033baf219bff54b6fb573b92456c00123c3bb0afd10d0f806393184e694b6a1

SHA512
35c2c60665e05fd3ba2f8a47bb9bfd4d860598df556449d6dc71fa9cba8fafc44c902578412159ae83ace7874885177799993017f2cab7595ef09d934e61b826

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3c6dc11f8da7a5fb0c3e934f1e60ece2

SHA1
8e2d621f4468e01b5391ecacb8fbdf31248ffef5

SHA256
af55d1a0387f021bdc1798938b8b42b734a85511c7f588ab9fde0a9b0434e5c8

SHA512
b183a36e8ff379a2638ea56fa37d3a916d98777da6067759cced5abb3dc75187a408c32c88f6d29a9dc1536adbb4f22e0ceb51a8bdd7a5479b5575006b03b60e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
23899af9646cdd8758424092860eeeba

SHA1
6651a69a8abba545a98a8d47218057209beb420f

SHA256
c897ab038a2982407585c0ac54ed3a2a75b694c7b23123f764fd021641d584f1

SHA512
d3a9bfd92241dd5c7cbb33e3f2121f5af00a53f05a1f8f8ca7dbd8eef4fd3a508c80c1653564373b293d44e4af86cf0ddbf525cc9c1faa65c68f45ab6df4b9d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c701b2c6e3faadfcc92f3ec8211eb659

SHA1
fa8fdfd55d132ce1ec92be4f64cf66b469bd0e74

SHA256
81fd4a658a89a6bcf1503fe009178ff4645d56f4f3619c2f6c87873d5f26bd5f

SHA512
f6c4a16cc2c173f2aeaaccfd2074c028c068ab5e1b6f0277a5625a27ab0536cd7f06f85a9d519a355b23981680536be8bec8c8e23cb2f678599607ce98b11cc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
fd12e6c6603850df5f4adc3e98babd9f

SHA1
804b5ac0ecb38e43c4fe9bff3613605b49c91ada

SHA256
ec38defbc8b4b91d31958698c51ebd6df8b38a76d57a2ee066d60ad0675f3e07

SHA512
d72c782e7c54ecf9b34d7c576372125b435fc21690523e444851441600dd6aff591229b63691cb5ddca46c753e553b31760c9e7b87c603a27939355bbd0c124b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
64593c47270fa1423634f38a828947be

SHA1
7a2ec35a3407a4e22709f6c77699769515e1bcac

SHA256
39ce9eb23ceba5e1a2b43728713c4a904d6e4be4fb705655e75ed6ad9562ec5b

SHA512
168e581eb2f5fbde570da08b8c1087ceb7c9679bce5bb4d59a08e44dad52b82141d195f81432522de8fec1095a36e01eee1be20d8ee3942b9479065c3cc0b650

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b1b04afedec91e9df6c1a9ea6ebf6fe2

SHA1
11438d950577b4f00eecfaca3bfb7ebc6a8f4cce

SHA256
0f1c6629126ca46addad84b7df13a8235fbb68cb5362ce2e9a62093c4f83ed27

SHA512
5a88923f39cf379ff3833bbd7f68661332d2c9e6fce1c68dbe7f2221fc199e2d007c1da39248339b74fac04898404f98e348e13d2552d4fa9ba4cf39902f0bcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8693976b0b11cfe23daa2fe9010cbd05

SHA1
7517cbfa71bb1b912d156c33b3200c2b1f8426ed

SHA256
e246bcbc6bdb8b6f69904d615df8449d490a99b2254309e9d36576ff335d2fb0

SHA512
fe4fe0b8ee76b8cf7cdda95b5cf9e6cc7dd4c963e258f3bdbea3c63e2b65bc44693f7d6bac33e9350ca03d5a31e1abbfd9a85a118c3fa2aa4405acae0ac0a03d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1a33e0c8d50617e2752fdbdcac6f48c8

SHA1
f7efcaad4f2e4edc1b51372742bca30edddca88b

SHA256
9b08057430ea4dfa505c519fccc53a4f85ed3ca7f82913329ff035cd5d5f4a26

SHA512
dd956e860a618134d1b0cf257670c0be37029765597b5111aba68add0428b1dd6e4dfbe75e54da0eda28ec1de3df884a666f0778d6f21b6afaa61e445b3b0238

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
0c4c6898121c871a8b4b038efeae255e

SHA1
d758e08d4d0872dc5a306bf4387b723d56328cfa

SHA256
7640f12d768a556c99260327c9510ded70114f9402cd5590857625e8f0c9b6a2

SHA512
85a5391163764c7dd41e2079ee5208459af8da2832bface61a3aad3043d3746344146b436b9346ad5ebe035b1e1b2ce24e4955d090e360394bb3a8f15af9fc06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
770ccda6bca6babb2cee2f713acf7eef

SHA1
f13c379d93a253cad0cf393375d5933a7693f321

SHA256
2927dc21d6c4aa0db4d516bc44a3ed4a4fa9bdf30eb29b141058506b5dc6ee26

SHA512
feb7a107a6310285719425d1b3e5c57f5cb8788d6130a69cbc75b65609052c79c4b1c83bbf88f36edfbec7b276b6d0317c615df7ac38beeeba1a067a68fd0eb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
236KB

MD5
0127eaa7bd0907f3767ae3f01e0931cf

SHA1
e535ffe2f6993417d6032dca7ce8389a3989fa64

SHA256
40fe9be02f36af0e140f334707efee1fb3fe27a96fb46a90bcbbb6c1e48a8533

SHA512
778c68df8c7e62127105c869c49aa80de158eeeccf3aa586d5f8c94daf318fa66b0e2e77a457e083c99c9073d331ef3dfe0bedab9c9c248e5f0419b65fd854e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
236KB

MD5
73d65ea88d66eb2a8db4b9bf4f21d7d6

SHA1
f3d6964f953590101ca273e1a260861f0689d717

SHA256
e7cf99936077982926923318ea3bad19b19e6a6d59eb82ae6adcaed2589f6158

SHA512
d0de2103af9f932d52de0c4bdab0c1fe79bbd1a08b306999d3c82f562b8de865b35b451cb42773a7ed30238d855abddea68ca2677d3c87ad938828e855880a31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
236KB

MD5
4f6b96ac4bd6c73b0cb88775ba923001

SHA1
30823b5514f6f80dba2598910f6c81b2b56124d4

SHA256
e964e6b3857176255b6981d852f232e4171ff45a6d68aea7e59a567cdfc74893

SHA512
249a7475fb4a80f7e7b9bd0deaa23653b09f9a0b93a163ea84effc522379d0ad8a500eab343ea60eabf133a286ccadadcddd67338c2e34d9effda3933ddf632f

Download Submit
C:\Users\Public\I

Filesize
144B

MD5
d1e3f285f190230d14aa3b299f52417f

SHA1
f7bb9af753504380476464d4a0103e7962a53279

SHA256
34d42f03c06754a4393982cea97d357eac670134e620962e7aa1f4f96c344a2b

SHA512
a5428ff828d83e0c71c417517e83f84abd73d2d5d6e3f885ed6d835bb68f3194d4d460f2c2972705bb47b9c27627c49ba99dfdbe9683eaebc797ff20f94ffc26

Download Submit
C:\Users\Public\I_

Filesize
3KB

MD5
890911085e36d9df76b93d3d329cd795

SHA1
698078e0523eadde1d00a7ff1c562cf2331d5f11

SHA256
c570a1b662eba8749c1cabae837dcc9d790849bf0fe451225a1c20a480f9eaa4

SHA512
4e63638d51aaf0956fcf22785c01d6920f6d2dcea83a5b6a38c173b0ad83d4f22218fa55b3222b1560a693a8271a6804e4af3482ea756893a38aded02c8df372

Download Submit
C:\ht21b5x7\WWy0

Filesize
4KB

MD5
0b8c94082af034a12dbcd044324b2185

SHA1
490b0ce632f241cbdd145222db4198e77bbe41e7

SHA256
ce66700faca3da21b2d8dc619e0cee032e0e50143d888b1d7a1de152f9dd8a0d

SHA512
41e3a8fd8e835259887c75ff320a1c8c0600864ff81bc7cd4703dd51fa94508d82d8ad67c8e2cc015e5132fe77d591e1039971889617b8d516d15c1368f8501f

Download Submit
C:\ht21b5x7\uoo3758yi91.9iy

Filesize
6.5MB

MD5
74610db92b577b7cf450fc7f342ed893

SHA1
e89804298c31f1f10705456747d422750b7b8ca1

SHA256
528d9ce3547a516ef5ed26df867aa4c62bc25acb579da669f1c21475013dfe96

SHA512
53a239f13b820ee9e243e6159d402baad3b97ada7c72b0e0dd60ff6fb17a403516986d2aa72bfc6cb08e2899dc30e0c1031981b05b24aec9240f6cdde037d827

Download Submit
C:\ht21b5x7\uoo3758yi94.zip

Filesize
256KB

MD5
1e80c45e7a5b3d785b41cec286d2ff80

SHA1
9a20c04f9e70a618b455ce768eb173adbbff19ce

SHA256
289957dfa26cb8f6f92146f62aaa9e515a33556bc21895018bdf7903a2483065

SHA512
57e7d9bca0d8caa7ff7d749ac81d98cead587b8407a4bec7782a3cb0e10ab4a6ac9b38e50981ced0a0a84746dacf394b55e7830cdfc71a337ab77d3924274a2d

Download Submit
C:\ht21b5x7\uoo3758yi9a3.zip

Filesize
475KB

MD5
4ede770867bd4ecff58bc6c5f7674756

SHA1
6ead54cdf4d5a9fefeab4da924d2add935dd4da1

SHA256
b3f5dccbba26bffa2ee3568f336fd22e840c12c9822318b68d2211ce0df43ab3

SHA512
48551dff7d001bad772171c6b320d4f8ffdc3eea7fd0c13f535252adba91a8cd3493a678d6e097e6bc831e065a916d29ca9938de3a4b99aedb8e8a24137a87f8

Download Submit
C:\ht21b5x7\uoo3758yi9ai.exe

Filesize
925KB

MD5
0adb9b817f1df7807576c2d7068dd931

SHA1
4a1b94a9a5113106f40cd8ea724703734d15f118

SHA256
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

SHA512
883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

Download Submit
C:\ht21b5x7\uoo3758yi9m1.zip

Filesize
4.6MB

MD5
f445fb71cf478a86aa1e8c7cbcff7ea6

SHA1
5f86ae87a935cc33f50e13446a672fd3bbcca883

SHA256
9b470561631da04868090f0414e2a714da42f4af9a6343d793e83deb27f24f96

SHA512
212deacd0cdb06490d46803b1379899cdc46eb8a05fb9894de6372387f113e07a1fdccb39c29dff1af63c54e49fe87f6ba35be84515d260bf6196c7304854f89

Download Submit
\??\c:\ht21b5x7\libeay32.dll

Filesize
1.3MB

MD5
de484d5dafe3c1208da6e24af40e0a97

SHA1
3e27b636863fefd991c57e8f4657aded333292e1

SHA256
007342c6b9b956f416f556b4bd6f1077e25bd077cc4f4ac136e3fccb803746e3

SHA512
e871ba131965331dcd6e7ae0ef02734e157676c7d2bba791dae274395eaac90df3e0851bd67f1e12461287860281d488e7e82c9c11cbf4657052eec78f678c3d

Download Submit
\??\c:\ht21b5x7\ssleay32.dll

Filesize
330KB

MD5
284e004b654306f8db1a63cff0e73d91

SHA1
7caa9d45c1a3e2a41f7771e30d97d86f67b96b1b

SHA256
2d11228520402ef49443aadc5d0f02c9544a795a4afc89fb0434b3b81ebdd28c

SHA512
9c95824a081a2c822421c4b7eb57d68999e3c6f214483e0f177e1066fe3c915b800b67d2008181c954ad0403af0fa1ade3e4ea11d53ab7e13f4a3def9f89cf4f

Download Submit
\??\c:\ht21b5x7\uoo3758yi9

Filesize
255KB

MD5
77356d80c36968871e711f621bb0327d

SHA1
772211c0f13dd2d62f0e6fa536f20da018bd7e19

SHA256
85d485e976483e822d2f820e2e88fb5ed09c31102172667645c45938c8d924dc

SHA512
008611cabd53119c08da7d4c9aaafc87d593c157751739f8aaa89a60510e55c22d62a4ce5fc5c2f57c6c23264cd80a37f31b1f3244dfc5cf4119e3b08b99e72a

Download Submit
\??\pipe\crashpad_3884_SMMWFPKJQZTSNRNE

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1248-704-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1248-705-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1620-121-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/1620-123-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/1620-122-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/1620-124-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/1620-127-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/1620-415-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/2736-752-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/2736-777-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/2736-762-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/2736-763-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/2912-561-0x0000000000340000-0x0000000000360000-memory.dmp

Filesize
128KB

Download
memory/3420-753-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3420-754-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3688-116-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/3852-389-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/3852-400-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/3852-703-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/3852-401-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/3852-404-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/3852-403-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/3852-391-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/3852-386-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/3852-731-0x0000000000400000-0x0000000000A8B000-memory.dmp

Filesize
6.5MB

Download
memory/4212-521-0x0000000000370000-0x0000000000390000-memory.dmp

Filesize
128KB

Download
memory/4212-522-0x0000000000370000-0x0000000000390000-memory.dmp

Filesize
128KB

Download
memory/4212-524-0x0000000000370000-0x0000000000390000-memory.dmp

Filesize
128KB

Download