dcrat | hxxps://cdn1337[.]site/123[.]txt

Resubmissions

14-01-2025 20:16

250114-y2jj2a1jbr 8

14-01-2025 20:12

250114-yzbfmszrgj 10

Analysis

max time kernel
123s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
14-01-2025 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn1337.site/123.txt

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	2436	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	2436	schtasks.exe	104

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
4004	physmeme.exe
2136	Winver.exe
3456	physmeme.exe
5060	physmeme.exe
1276	physmeme.exe
3084	Winver.exe
2996	MiniSearchHost.exe
1492	physmeme.exe
624	Winver.exe
816	physmeme.exe
248	Winver.exe
2512	Winver.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\dllhost.exe	Winver.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\dllhost.exe	Winver.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\5940a34987c991	Winver.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\MiniSearchHost.exe	Winver.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\1969ae1953a317	Winver.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	physmeme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	physmeme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	physmeme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	physmeme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	physmeme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	physmeme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3856	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133813592182260780"	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	physmeme.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	physmeme.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	Winver.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	physmeme.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	physmeme.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	physmeme.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	physmeme.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\123.txt:Zone.Identifier	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3856	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
624	schtasks.exe
236	schtasks.exe
3036	schtasks.exe
4392	schtasks.exe
2980	schtasks.exe
4376	schtasks.exe
2996	schtasks.exe
1092	schtasks.exe
5096	schtasks.exe
3356	schtasks.exe
3084	schtasks.exe
1100	schtasks.exe
4412	schtasks.exe
1272	schtasks.exe
2092	schtasks.exe
696	schtasks.exe
1464	schtasks.exe
1700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
2136	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe
3084	Winver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
336	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4504	4324	chrome.exe	77
PID 4324 wrote to memory of 4504	4324	chrome.exe	77
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 1488	4324	chrome.exe	78
PID 4324 wrote to memory of 604	4324	chrome.exe	79
PID 4324 wrote to memory of 604	4324	chrome.exe	79
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80
PID 4324 wrote to memory of 3168	4324	chrome.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn1337.site/123.txt
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83b28cc40,0x7ff83b28cc4c,0x7ff83b28cc58
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2300,i,7594285678468034426,5794056883204016593,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1704,i,7594285678468034426,5794056883204016593,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  PID:604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1932,i,7594285678468034426,5794056883204016593,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,7594285678468034426,5794056883204016593,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3092,i,7594285678468034426,5794056883204016593,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4436,i,7594285678468034426,5794056883204016593,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4784,i,7594285678468034426,5794056883204016593,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5044,i,7594285678468034426,5794056883204016593,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:4648

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4200

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:336

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:1632

C:\Windows\Speech\physmeme.exe
"C:\Windows\Speech\physmeme.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4004
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ESD\9aaHDVpcxKfYtJqSuujTUaPokkSzlaj3bXCELnPfmUbbbzmgl5.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ESD\r9FE9AzSI.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4644
  - - C:\ESD\Winver.exe
      "C:\ESD/Winver.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:2136
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3gMOD1Yyzd.bat"
        5⤵
        
        PID:4396
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:364
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3856
      - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\MiniSearchHost.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\MiniSearchHost.exe"
        6⤵
        Executes dropped EXE
        
        PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MiniSearchHostM" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\MiniSearchHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MiniSearchHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MiniSearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MiniSearchHostM" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\MiniSearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MiniSearchHostM" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\MiniSearchHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MiniSearchHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\MiniSearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MiniSearchHostM" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\MiniSearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Users\Public\Desktop\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinverW" /sc MINUTE /mo 5 /tr "'C:\ESD\Winver.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356

C:\Windows\Speech\physmeme.exe
"C:\Windows\Speech\physmeme.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3456
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ESD\9aaHDVpcxKfYtJqSuujTUaPokkSzlaj3bXCELnPfmUbbbzmgl5.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ESD\r9FE9AzSI.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2256
  - - C:\ESD\Winver.exe
      "C:\ESD/Winver.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Winver" /sc ONLOGON /tr "'C:\ESD\Winver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinverW" /sc MINUTE /mo 5 /tr "'C:\ESD\Winver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4376

C:\Windows\Speech\physmeme.exe
"C:\Windows\Speech\physmeme.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5060
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ESD\9aaHDVpcxKfYtJqSuujTUaPokkSzlaj3bXCELnPfmUbbbzmgl5.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ESD\r9FE9AzSI.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2980
  - - C:\ESD\Winver.exe
      "C:\ESD/Winver.exe"
      4⤵
      Executes dropped EXE
      PID:624

C:\Windows\Speech\physmeme.exe
"C:\Windows\Speech\physmeme.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1276
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ESD\9aaHDVpcxKfYtJqSuujTUaPokkSzlaj3bXCELnPfmUbbbzmgl5.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ESD\r9FE9AzSI.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2472
  - - C:\ESD\Winver.exe
      "C:\ESD/Winver.exe"
      4⤵
      Executes dropped EXE
      PID:248

C:\Windows\Speech\physmeme.exe
"C:\Windows\Speech\physmeme.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1492
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ESD\9aaHDVpcxKfYtJqSuujTUaPokkSzlaj3bXCELnPfmUbbbzmgl5.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ESD\r9FE9AzSI.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1276
  - - C:\ESD\Winver.exe
      "C:\ESD/Winver.exe"
      4⤵
      Executes dropped EXE
      PID:2512

C:\Windows\Speech\physmeme.exe
"C:\Windows\Speech\physmeme.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:816
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ESD\9aaHDVpcxKfYtJqSuujTUaPokkSzlaj3bXCELnPfmUbbbzmgl5.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ESD\9aaHDVpcxKfYtJqSuujTUaPokkSzlaj3bXCELnPfmUbbbzmgl5.vbe

Filesize
190B

MD5
e652dbefdc14989c6c143840598688fc

SHA1
f7f8bd9277540b5dfe61608f9cc294677c235d9c

SHA256
931f80ee9a44026f30b6f243c4a4b77c344d1c039548ca29028822bc8608f80c

SHA512
99bc14f9515b438bb9c530b5785ab45d49ebcae6cd2e6dc8ace02c7adacd34eae576318db901e059092e596b2592334eeaceb675e9f887caa9a1c1cfe55837ed

Download Submit
C:\ESD\Winver.exe

Filesize
1.8MB

MD5
d4f263a3feebfe196d5eceb651c9ffb7

SHA1
dde163a9747f48004ed85777ced25062b16c62d7

SHA256
c91143795474ec192096650cddcacd5d4e0d46b384e8a56dab7ca029ac2a7d43

SHA512
f933264ab7fe364946619938a6997566f583f69a8d75698da4ad77833ce9e4514153fc5d54477fd9e19ae12e5b7fe19bdbc2a2c17a51d53f3c632a48635aa967

Download Submit
C:\ESD\r9FE9AzSI.bat

Filesize
70B

MD5
49df7cd2be033c4b1f2de946daeb968b

SHA1
3c6fda5eda780f3f7016ebf969697b8f365d06fd

SHA256
6a8c02efc7143f4ee54e6e13a10050b525d265e0b5fcad04510eeae61e6561cd

SHA512
cc4bb5b8c22a65e4b2c6ffa1dfcaea0a97fd651aa6d39922b461ee33a95fbd3c11246808d416ad16f570a882f4d77bb2cc851421d39f4caf92155e28dc1e5b3b

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
707e3e6e3969d5883355346e82ad65ed

SHA1
eda442e41dbddadd2e876b369e060e5e32340cb6

SHA256
dcfd7b0b9b4c9e06a0244b6c4b5bdca679dda4e6f517f4d1da5e9e8fb4eb2845

SHA512
f68b49e3ba372bb536ad148fee96d4a25c947aa3f22ee2778f4485d05327d33709ff6d634967ebff9071f3ac09d61394c59977028a4fd2e25f1f510f3ef9690d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
1d1f33560499ee14b8e71c03dea8d8da

SHA1
95f8daf1811ee905c3db5d3069c704e1b89c0a73

SHA256
13ed637144a7dcfafd61d2011c5d426cbfc9b4b9be4ea848a3360d31da671550

SHA512
07fa4696f2eb84df9e8a5b77c9b40e78273c197bb5c4be9fca76875dd874f6ef615607912981d425ae3a40d2d28ce736bc0c8695d9e23cf8ffa2ee7c88f300b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
d4bc1a95a76e5d9cb8b722e41729a9e4

SHA1
650eeb597d33bea2e8a14abeac5a0539bbd9928b

SHA256
fca17b99042a0ae3c5753382d01620fb1c008fafcf6085b7f1f6f507ed4eda06

SHA512
e918bb4b0c3283acc25a047bfeefa0d4bbe5bba1e582d9865aa284c5d8d9f527e1a3fec6f8cb7551052506161889bb6965b7308205b84f3c8c4f9997dd7e81e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5b1ba7b7cf03d9cd7ea00cab3ad44aa7

SHA1
9b23a7d6629de306f57745185d90c08f67f56dde

SHA256
9469b8ad5be1a0ddfb5f8aefaa3aeb7475745b022cb0c5f32c05d74f433fe25e

SHA512
0dfd6349b1de63b6a04e04d4569cfd928c53094b65d6f759bf184ed2a6d79404a13e6f567c907908729f6080411a298bff2c0384d928946d3fef2e62a9e3f2e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8df141e2a94d39d8a9ef5e4a5ed65b90

SHA1
25183927c4f70c0bd128d59662329964d5104bba

SHA256
7de7ca2be3b336d094a90572eb036639779b7cc2b888de0c10bf9843a25dee73

SHA512
da69dcc698b4cc1fa27808bf1a8536a772b1fa429ed71361d0ef4be9427f5b1cc2b0381cb125bf2ab646940d389e6c8ada760b07e5431fc49fb6aa1454b2c89b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
263dfe1613e1a62988cc50e8c72b48e7

SHA1
9255d84e24d9a79c36c5b0fdd9325a1cca030cf5

SHA256
0033042bce8ba56c0121399664d1ef3994838e26ef7d30aebbe169e84eded1d5

SHA512
bce0ba8124a64b8c07e4f5e2eee079257eba79cbd7e73b13942f1bc118865d83d39c96715b8b89163e5ef801c5027d659528a96b64ff42db12d6130cd1c2d9e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
22deb1a0acb58229eec4768c52e708d4

SHA1
2e5566bc6cb8add3ad60d23c85c07e89a43ac5e9

SHA256
d43d54df72fb01e9c3503539231b0a4f18fdef782581bb8f95fb0206a82186b8

SHA512
c8099775acb24f907db1a7a23bf33ebb1d2cec667e9f44bc85f3d124a60897d34c24ac4b88ed9ff3853c46fc769f373848b920d6dbb7d645ef0ce16c63c3b989

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2c77464094bc36173d714655c98a13b9

SHA1
3d61912f7446cb1fb757f5fe6cff1b4208cfe0fb

SHA256
d5f2a188ab1ddee353309af62fa8de0f7e216a9127bb23ee97157a65cd65a5a0

SHA512
129af18812049e5f852ce3e2c38adb04459dc1377181acd9cd928839f4998d109e1d6439442a83a8b7e6381b857e7dfc89cafa1cb3fadc2c184267a58f51e7f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6d7d53c132018eb536fcf6045534c559

SHA1
ecd4000569bd8f375bcb5e203101f438b6cad8e8

SHA256
d8190753f9024879fc1e5be20dd9802141fd568071834c97526893c3dafbe086

SHA512
acce5d5e1ff5cb96fb870e5b5763a35d797a0c0e690e4dd90d622ba179c7d408a92b570cec8792255fe64490d05f79f1df1a5540f12ea584f2697af4121260d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3f58e83ce85578ec7fc9cfece2c060d7

SHA1
19268e101ec2e24c796b9edb52b1c20571c37d3b

SHA256
45e881769254f53b6c0dd5cca52d2477ecdb27ae9709a27a82d8f0b4a1d6c341

SHA512
4b7b752ae29c7e3ba0dd72535bff53034881d7d37536fec6446fc26214a771b76ee4c8be36614755863bd9d2a84ee677329092a347873d7196a5598f98a9a48c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
aa0b8c93cf3cb45aa8028d58b8d83461

SHA1
abd998fd442db188e6b77b71fc3b1488842935e5

SHA256
0db346096927f86e2b11d50a8d73e9793659a78459c0a453e635c7ba76fba49a

SHA512
ef92e80ad793a06c4aff8736d42f78fd6fc879837861c58c62b55f506e8c592fc85056039736c7dcb4868ae418dfa0809b9b5be0c5490705f1ea019892d13855

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
11d2ee9a042db21df5c41253b57c7d4c

SHA1
efd85733b90a59ab5abb05ab35a9c55503424b5d

SHA256
5199a0dc02541eb199317014bedd2a4152d04895f0424e4ecb481b3f693a7651

SHA512
d93c8de9dd1d81d4e7fd09a343cc539ba2ce97abf179ee023434a86d9411884e39bb81ea4f2080b2231a2f897c0705037acc3009ffbc358b413db2e394c4571d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
338048db38f08f362892abb50419bddb

SHA1
d57e50a7af73e85c12a6a5a857b4c13b978a6721

SHA256
4848919d3c482c9e6765cd4cc05a227405d97fbe32de1d332405f049263b3bb3

SHA512
aa079df20e68caf818360fc5c46059e2166b6527e5acc43bd55cd4b64bd16b3ab0ec83360c9298602f269d8debec3c63f3adbd8674cc2f0cd7b3b691b42dcf97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Winver.exe.log

Filesize
1KB

MD5
1126a1de0a15000f1687b171641ffea6

SHA1
dcc99b2446d05b8f0f970e3e9105198a20ca9e78

SHA256
b886b6c74da838e87b2cbc539ee657a2817d126b55c0cbd6d1ab91480261bcc7

SHA512
6cfb73ea43899ffa3cecd354cd76b0a1a67f57d9054c3e31cff43424491ed3bceae5aecd0f5c414ba92aab539eb7d55af3d40eedde80c9af8d34649bb1f8d4b4

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
96329c73cc49cd960e2485210d01c4d2

SHA1
a496b98ad2f2bbf26687b5b7794a26aa4470148e

SHA256
4c159cab6c9ef5ff39e6141b0ccb5b8c6251a3d637520609dfbdd852fa94d466

SHA512
e98736a879cad24c693d6c5939654b2fd25bf9d348f738668624214f22d541a9b781c967201ab2d43cbac9207946824a0299d482485f4b63c48d5d2a839e5baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\3gMOD1Yyzd.bat

Filesize
208B

MD5
a93e41842d8a4f28086d2c6b3b2c7292

SHA1
afe600c122e9891a79a51bed1f5b449ae8ae620c

SHA256
925fbdfd220a2109f8a2daeba84fa56666e1b02e05a7a8d733a441bbec2b5ede

SHA512
7abe382f4adb341decd9d59e855174151d9ee6e34d19102e2ad99c9be48dec6c91f9cdd4f1319dab01af26eadb25003bd75e2aa5be99cc8e383a47a5c9fb3b4f

Download Submit
C:\Users\Admin\Downloads\123.txt:Zone.Identifier

Filesize
64B

MD5
49153f0e14ca005728d993eb716354e2

SHA1
170222e244f44af88e7c3d5a8ba01e79e277d70c

SHA256
10052b34934c62c6bb73d5378dd4ba91331f55374a775e8da09e1cad598f1975

SHA512
2667691951bb158199f6b37c7a17b9d850f7753748a7599453b02de86a4a568fe9659ec49ed84f06b04315b3d238aea3c48f39bbd1cfc6a9fc0c54ca98851392

Download Submit
C:\Windows\Speech\physmeme.exe

Filesize
2.1MB

MD5
261edf92e8d85c7a9f7151080ea80467

SHA1
be7cba5291a89ccaed22bfb092a7651d34a36def

SHA256
e21cfe74517aaaad37fd5b4825fa4eb97edc6c8daeb386e0cf562b5901f7fdeb

SHA512
bec64fce5dc2a93edf16963236c975409ca4f40c8809e6a16661578d99ff0fd09178c0d7c293211f6da2419342e71e9532f17d6e455a5ef573326c4fa7fb7c8c

Download Submit
memory/2136-150-0x0000000002D00000-0x0000000002D1C000-memory.dmp

Filesize
112KB

Download
memory/2136-151-0x0000000002D70000-0x0000000002DC0000-memory.dmp

Filesize
320KB

Download
memory/2136-153-0x0000000002D20000-0x0000000002D38000-memory.dmp

Filesize
96KB

Download
memory/2136-171-0x000000001BD80000-0x000000001BE56000-memory.dmp

Filesize
856KB

Download
memory/2136-148-0x0000000001500000-0x000000000150E000-memory.dmp

Filesize
56KB

Download
memory/2136-146-0x0000000000960000-0x0000000000B32000-memory.dmp

Filesize
1.8MB

Download
memory/3084-213-0x000000001C6B0000-0x000000001C786000-memory.dmp

Filesize
856KB

Download