0e57b06421c1d0770a748d5bb5a3b15bca3ce9b1b9bbdfd757fa0f8c5f13c513

Resubmissions

11/05/2026, 17:20

260511-vwnd9aaz2k1

11/05/2026, 17:08

260511-vn28faay2p6

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiskGenius-Pro-Crack-2026-Download.zip
Size 2KB
Sample260511-vn28faay2p
SHA256 0e57b06421c1d0770a748d5bb5a3b15bca3ce9b1b9bbdfd757fa0f8c5f13c513
MD5 e1d157f4b0f2a158ee087732aa3cbb20
SHA1 e236de78148a52fa72f16b6d0a550248a25f337c
SHA512 2631ef1107ab213951908f74de5b02f7eca6d31d8bb35782205f80aed172db6a7a4feb492a31eb6e7a84a42494b9cd9e28556f06060a48a305856690f2fdcec8
TLSH
T18D41501EC06648DFCA5A323E21184F23DEAAD91315B2914172E37031FE03AE23FA091E
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	camo.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5032	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229930997787350"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\setup_x64.rar:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5984	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1808	OpenWith.exe
5984	OpenWith.exe
5984	OpenWith.exe
5984	OpenWith.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 1748	4356	chrome.exe	83
PID 4356 wrote to memory of 484	4356	chrome.exe	84
PID 4356 wrote to memory of 484	4356	chrome.exe	84
PID 4356 wrote to memory of 5032	4356	chrome.exe	85
PID 4356 wrote to memory of 4588	4356	chrome.exe	86
PID 4356 wrote to memory of 4588	4356	chrome.exe	86
PID 4356 wrote to memory of 2776	4356	chrome.exe	87
PID 4356 wrote to memory of 1440	4356	chrome.exe	88
PID 4356 wrote to memory of 2776	4356	chrome.exe	87
PID 4356 wrote to memory of 1440	4356	chrome.exe	88
PID 4356 wrote to memory of 2908	4356	chrome.exe	89
PID 4356 wrote to memory of 2908	4356	chrome.exe	89
PID 4356 wrote to memory of 4756	4356	chrome.exe	92
PID 4356 wrote to memory of 4756	4356	chrome.exe	92
PID 4356 wrote to memory of 5380	4356	chrome.exe	93
PID 4356 wrote to memory of 852	4356	chrome.exe	95
PID 4356 wrote to memory of 4124	4356	chrome.exe	96
PID 4356 wrote to memory of 2152	4356	chrome.exe	97
PID 4356 wrote to memory of 1744	4356	chrome.exe	98
PID 4356 wrote to memory of 1744	4356	chrome.exe	98
PID 4356 wrote to memory of 5064	4356	chrome.exe	99
PID 4356 wrote to memory of 5064	4356	chrome.exe	99
PID 4356 wrote to memory of 4924	4356	chrome.exe	100
PID 4356 wrote to memory of 4924	4356	chrome.exe	100
PID 4356 wrote to memory of 1112	4356	chrome.exe	101

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\DiskGenius-Pro-Crack-2026-Download.zip
1⤵
PID:4380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff947a8c728,0x7ff947a8c734,0x7ff947a8c740
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,13283318792837947842,17867383706500785749,262144 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,1646093081506156236,14492374422857952396,524288 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2304 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,11066745530303707637,6136668602114138223,524288 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2560 /prefetch:13
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,17320599800325444710,10262943863488657113,2097152 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,9766660346933536117,5958965277499730234,2097152 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4228,i,9886729776629283995,14684920345454093790,2097152 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4268 /prefetch:9
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,714238986962793473,9511733424477637513,2097152 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,14782083332937505344,13787450683434693692,524288 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,13842951450336747835,939426131444277552,524288 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,9617680823952658037,11578390476517880356,524288 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5708 /prefetch:14
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,8540980165790494705,12405696247013270289,524288 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4300,i,9772441711826593830,16820645358442477403,2097152 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4668,i,14101930196768168653,2199619147718392753,2097152 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3540,i,13626428900687066225,575723972242837951,2097152 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4224,i,4123382092850839020,12840398126204395924,524288 --field-trial-handle=1984,i,4923927651298671520,4123345394706636785,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1808

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3a317a6adbefb32c89b0abdffd140c30fd7f184ec62d2c9de54c840ca751f45a
MD5 12fd43e9f2c7f32b5ba91967f183ee5e
SHA1 063bb83bc11619091b6aeb4b43f9c9000427351a
SHA512 df734480706e0f5e19efb69ef5319e8d999abc606167e4aced15e1d7575862f91cb95a8d3cf648f59ad6fc9514c51b853bf240bcb26f4ba08aaf40b2673ac0af
TLSH
T12EE02B9ADD719C7719FD0B2960500746F755135B2B50545F363CC5488FF1A2A858195C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a165bf86d081a04fce86d6fdd574ca0f8e52a272ab3bd196eed87a70a025aa12
MD5 5bf1c8c52f9ba81c780b65e8b6f88a2a
SHA1 02f61e800710fb9f8bed8c3447d8e3e47a2775f7
SHA512 6f747c791fc3ce55d7704e405893df2fa0917142c68007e93c91bde1bbcc36d1f974649e619cd7601b9adc8d80fcd39cbc91e63f4381ec921aa76b83d54dd17b
TLSH
T15371D81892907304EB18F77E98CB0CA07631C56AC067BEC67DD9B571A62E767F1B041D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 178dcc7a029b86f8edb419ca45de4db9919172015f7ddbebd4732c8654ff6a84
MD5 e2f3b1b9d5549b1db6f8b5a474cafcc7
SHA1 a3d73cfd3ec7851c62ae0c3b8112f9f234344aa0
SHA512 4a6e59627b32798e3d2aa5e186e5289f3228f024665098ae0a1965c578038ed63f14a869355361fe6d51acd155bd9d286fbb5327cde43a40e86f6c4e90a1b4d1
TLSH
T128818EF783E485BD8A1156F4EA14AE1FCE790924431C3C66C8E4AE4B97F2972D20179F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2d717ff78cb196782938798e5994a6979bced1537c2113739cba22d7aa1cd676
MD5 6f59a9f628b5c1d1d6f260f60cef03dd
SHA1 b5fc84e42ffd23b53580256edb9a4332bcf111a6
SHA512 b47ee9e7c8b152f21d5bef6ff7e86de26f289f6b1a0eb8ac63f276674478c24e29277a366050575c7de4ff693e68786070e80c53bb39ce644dc11a8e22c2a522
SSDEEP 192:jRbLhunIVKz2v7HYpAPRp2I98Hsb+WNnxhdQ22+3LAkwkVVyIsnAUgtaJ:jRbLyCcCEUXT6wTdH2+EA8
TLSH
T12042D72EF914793B9CCAC22FF922BB53D7F5102161951E84E6FC8A6C14E75CD222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f14900a5c6e132b91373a26e996bd5e70424b13d38d643018d57d40b990d7d94
MD5 6124117ebd515c2d7a042c9fe6ed98fc
SHA1 d9b0f2866c1ff1cd34cb2d36478b0093d08ffe3e
SHA512 2c882c126e34e95738ae0c9ff2fe1e3715c344ab5d7ccd8d3e59b271f6ff02a39f04d8c79332c25bb6a547206e97aa2c2c242dd45c21bda703af84bd0faba36a
SSDEEP 192:jRbLhunIVKLmv7HYhAPRp2I98Hsb+WNnxhdk22+3LAkwkvVyIsnAUgraJ:jRbLyCmSE8XT6wTdz2+E+e
TLSH
T1AE42E72EF914793B9CCBD62EF912BB53E7F5102161911E84E6FC8A2C14E75CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fff1f4204f117a2ce7fb9b54ba60e12bf3927c8a6febfe10cf355b1cdd8ce837
MD5 7b16e71e3b1435b005ddb1c3888d0e10
SHA1 1e8ca7df7ab7e2f007bfa97e8bad4626a4d9c8a2
SHA512 8d27bb6bd67b2f84b657d430e01c4560db33d3afe985a68fc8c7d9c59d3a7ff5f5f8e5d4a9eed262797744b3f956ea880d6755b80c981e7c4187b7c41afd3663
SSDEEP 192:jRbXgunIVKLmv7HYh1PRpRPQp98Hsb+WNnxhIBp2222+3LAkwklVyIsnAUgraJ:jRbXzCmSEPXW6wTQ2l2+Eqe
TLSH
T12352E82AF910793B9CD7D62FF812BB17E7F51021A5901E88E6FC8A2C14E75CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 74144bde8a93834e68f9a48a81014ce7287129353217573f1a238b72bd9ee776
MD5 e8a7131b2f5fce67df75f6b640423621
SHA1 c172f7d275a7bb4f792aa469105287662e52a6b5
SHA512 d87f3357ffc164932fbb3ecdf4bcfc75671f46e0f76dd96f6a0db1cd793b91f4fc6149469678241af076871d9cf95665488f029ef55370f86b1bcf1069437803
SSDEEP 192:jRbLhunIVKLmv7HYhAPRp2I98Hsb+WNnxhdk22+3LAkwkvVyIsnAUgraJ:jRbLyC2SE8XT6wTdz2+E+e
TLSH
T1E542E72EF914793B9CCAD62FF912BB53E7F5102161911E84E6FC8A2C14E75CD222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
MD5 40aba898dc4efcd9988ec53e06a8b15c
SHA1 af8b73cd37e29a8d0b68b474702174d179201fac
SHA512 1f184dc588afff9f591e8a55398deb52c19ccb2c739739b1384e2a6da49836e5a8171b750e21fad998d39b550d8f4906b846178327f24be8db946220ec5b5a8f
SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLcif3yXODVw+ErU3L5HGcHRXD:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pq
TLSH
T1D172FA676C4C9A770F94CACCDD27BF4FADB9024B65E9886443FA981903D5ACB010A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4f107a0a82d0a97b54d8ecb7924a0507515a730540b151864085b2f34a9db715
MD5 258b5efa21dc55e62eae3f0f8d28173e
SHA1 a13cc52d54c00af63921d515668a299a1bc3fd71
SHA512 042c0072406e1a969daf0324f2bc8dc00fd36d5d6b365eca7a2b1c64d6beea0e9e9113daf5616aad353b4bf53bcfd219aed0549d44ad8215a45509d4c5c9df67
TLSH
T1DDB0121080015503C04302F0128B048831149F118B05270153E1B975D8365E14114290
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595395.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595395.TMP
Size 96B
SHA256 96b19a012cedad7a4225feb17ec864f7e37ad856c2f170613304af07345f71cb
MD5 f833433b008853b4a7b7892a10bc7b55
SHA1 786b60fea2ef65f5d3dc98f5ebe7f4ce94728d1c
SHA512 998c78f82ef739bfad3ae2448f88e560177010d7da6a0e28c8aab9db7ff72e067576dc24caff09b5da92e3d161e3fd34b3c10908b148d6dcfc7019e87c0a6688
TLSH
T19AB022EAC2032202C00203F0A0828AC83020EF20C3032203C2E02A22CC202B000280A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 baabd33e5150c586e9e39ad3147c146a6dcc5cfeee5d0b76ac29c81a95dab14d
MD5 c07746174724bf8016d3d5023b214d96
SHA1 7819db9c9a06fcdf9d85122ae4ef6fdd0762b9cf
SHA512 58110927c0352bb6cbe85f33788a2d6ae5572ea4ee8896f4e5302df49de4d475a016a051d99bb35248a6b899d0050ff03cceeb339ea76ddaef7e5eba5380958b
SSDEEP 3072:9dvea7+ycLb7kUjtBE9g3jy66N3Me5Y++J3qUQm08KMWF0bFTcVHr6zL:99h7+ycLGAy1NF5Y++JjcMW2VcVLw
TLSH
T1281413A5E91EFD3A12AB5222E10B8CEBCCD3ED8C1928157C1347AF1F296C3526357C64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 505bdffb2fef5a02f93675934e848c3e00b71e38386044989ef1a4086f72bc06
MD5 4493ff2e44c0b524ead1bbdd7799dfdf
SHA1 276eedc45f99d073d047601a6603d2470d05811a
SHA512 815110625a09ac463ecdcc3ed47b695f392944853e048333e05939977f3a05cce1f294f2f0ccd4502a068b0e800a8e81b47a2d35d1613b9fee9dd76afd4cd6ee
SSDEEP 3072:Idvea7+ycLb7kUjtBE9g3jy66N3Me5Y++J3qUQm08KMWF0bFTcVHr6zL:I9h7+ycLGAy1NF5Y++JjcMW2VcVLw
TLSH
T1961412A5E91EFD3A12AB5222E10B8CEBCCD3ED8D1928157C1347AF1F296C3526357C64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 9c4b8e2481ee9a5154f4bf93ae9b58ac86d06ed0d5e8c5538e7e78d8192987d4
MD5 7c04f488822778319d018b6c4479c717
SHA1 1027696a94b11410669964784d7c002bd99a11ea
SHA512 ee519ba3a16d4d7d50282600e313fe7c1172c65ffb4d4e4ca5b4c4594365c8cecde3cec2c9584ffcece23944a65d4b9b8882aa4cf761bf935f5daa6e0322d433
SSDEEP 1536:wS/yP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:54++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1B59312B9991E7D79236EC796A0179CAC88D3DCDE151410BC30C76F1E14BB392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 a22a495f1083eb1985ef62e52d517bbdd5ae72e5589185aec4ad064378bf2f90
MD5 cb8663bbf5c13454d0831e1060407a84
SHA1 9a8de5d6b29dc8ac4a739f0c044970d0ea370657
SHA512 60b2a8bc33dcf407af5f314e457540599ff498af58b0268e10d34807bf7839f0e62bcf81708b4a2aaa85b46cd974491e318d77efe4560ea2cbb893dcdb71dc13
SSDEEP 3072:9rvea7+ycLb7kUjtBE9g3jy66N3Me5Y++J3qUQm08KMWF0bFTcVHr6zL:9zh7+ycLGAy1NF5Y++JjcMW2VcVLw
TLSH
T1E81413B4A91FFD3A12B75121A10B8CABCCD3FD8F2918693C1347AF1F256C295A357864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup_x64.rar.crdownload

Path C:\Users\Admin\Downloads\setup_x64.rar.crdownload
Size 13.4MB
SHA256 15da012d588874df4d24afcf9da01464f4973f5e5611d2db84db77780bec04d9
MD5 499f0977a5a8572973c67b19c1a186dd
SHA1 97c3c867d286ec77472cfc566e1200a883eb3ae7
SHA512 7871f20782201ea135f7f4554699b874ad2df66519495eed6da01b7c40ddbcbf083954951f66508c9bd1175888924d05d020970522b696c8964d39d4f9f9fda8
SSDEEP 393216:4M91vh835BSVaLlhy3W5dB+s0rumv6IerMObxUyENiARZrkbs:4Av8+4m3Bs0r4IeMAUyEsAAbs
TLSH
T1E3E633A33D84448997ABD609D01B488055FE97CFB3A2D8F1BD58F84F660222496FEF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup_x64.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\setup_x64.rar:Zone.Identifier
Size 1KB
SHA256 42755c821988b3fdd5f17c82e32309a9a6b084771ef627dcb6ec7de3a3c29355
MD5 7681d1d4dfdd85c603ee7ea63c07803f
SHA1 b12d2bf967efc5b838503a2a30922ef25b41d670
SHA512 e7d66fbbb9e212c6b02353573f1249c3dc9eb1c3d2214d3481150f667b4dafcaa69c11ed18d16126b77cae69829ad33e2555bd52d286145155af9787454939cc
TLSH
T1B2114FE7B42AD41B0B0AA0E6CA4D1DAEA41FA6978A05428C54AFC045D0C00B8A0D643F
MD5 SHA1 SHA512 TLSH

Submit Download