hxxps://xcityweb[.]com

Analysis

user interaction
yes
max time kernel
104s
max time network
106s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xcityweb.com
Sample260710-lkyleagy8j

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2768	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{FA323F64-AEC0-4079-8669-E4A030AE39D0}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 5876	2364	chrome.exe	86
PID 2364 wrote to memory of 2296	2364	chrome.exe	87
PID 2364 wrote to memory of 2296	2364	chrome.exe	87
PID 2364 wrote to memory of 2768	2364	chrome.exe	88
PID 2364 wrote to memory of 4960	2364	chrome.exe	89
PID 2364 wrote to memory of 4960	2364	chrome.exe	89
PID 2364 wrote to memory of 5792	2364	chrome.exe	91
PID 2364 wrote to memory of 5792	2364	chrome.exe	91
PID 2364 wrote to memory of 3676	2364	chrome.exe	92
PID 2364 wrote to memory of 3676	2364	chrome.exe	92
PID 2364 wrote to memory of 5636	2364	chrome.exe	93
PID 2364 wrote to memory of 5636	2364	chrome.exe	93
PID 2364 wrote to memory of 4840	2364	chrome.exe	94
PID 2364 wrote to memory of 4840	2364	chrome.exe	94
PID 2364 wrote to memory of 2548	2364	chrome.exe	95
PID 2364 wrote to memory of 3668	2364	chrome.exe	97
PID 2364 wrote to memory of 3668	2364	chrome.exe	97
PID 2364 wrote to memory of 5700	2364	chrome.exe	98
PID 2364 wrote to memory of 5700	2364	chrome.exe	98
PID 2364 wrote to memory of 5388	2364	chrome.exe	99
PID 2364 wrote to memory of 5388	2364	chrome.exe	99
PID 2364 wrote to memory of 6132	2364	chrome.exe	102
PID 2364 wrote to memory of 6132	2364	chrome.exe	102
PID 2364 wrote to memory of 4800	2364	chrome.exe	103
PID 2364 wrote to memory of 4800	2364	chrome.exe	103
PID 2364 wrote to memory of 4508	2364	chrome.exe	104
PID 2364 wrote to memory of 4508	2364	chrome.exe	104
PID 2364 wrote to memory of 4868	2364	chrome.exe	105
PID 2364 wrote to memory of 4868	2364	chrome.exe	105
PID 2364 wrote to memory of 3708	2364	chrome.exe	106
PID 2364 wrote to memory of 6008	2364	chrome.exe	107
PID 2364 wrote to memory of 3708	2364	chrome.exe	106
PID 2364 wrote to memory of 6008	2364	chrome.exe	107
PID 2364 wrote to memory of 6032	2364	chrome.exe	108
PID 2364 wrote to memory of 6032	2364	chrome.exe	108
PID 2364 wrote to memory of 2680	2364	chrome.exe	109
PID 2364 wrote to memory of 4704	2364	chrome.exe	110
PID 2364 wrote to memory of 4996	2364	chrome.exe	111
PID 2364 wrote to memory of 4704	2364	chrome.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xcityweb.com
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa180bc728,0x7ffa180bc734,0x7ffa180bc740
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,11268674249538647983,12057439396193793835,262144 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,16743446444497810035,12866386605526783635,524288 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,3693234856540772719,1786067623326847567,524288 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,11275049769568138537,7307001027557335211,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,10088635234434971512,12710068114596769996,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,5282874340088271256,17374828242788261865,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3892,i,10269643335620982176,11343254170744854853,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,14406270120602769177,9144661189143078760,524288 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5736,i,11013374769012369424,12227273518827787627,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5776,i,16154714401308390951,902348876066257363,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5800,i,11423372187322597463,11534626402985844456,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6188,i,6490411067847574873,10113931041560114681,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6464,i,5003161544882364988,11308868960867853994,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6060,i,9261983940357998763,1535836771596071079,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6028,i,15799557317265892318,8137236511532715478,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6796,i,7277928188808557158,3036499347945629634,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6768,i,14900611950919991186,8363274851665909702,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4948,i,16412800957486262507,17879245142083778586,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,18211131777351830006,9130274683466205762,524288 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=de --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,13142957999616299463,2977592101515473431,524288 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:12
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4964,i,7747491423220676042,18141589192666789403,524288 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6468,i,1065564603231714169,14554678273004572439,524288 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3912,i,5860866331965115992,4558353525156848754,524288 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,5577707946069129912,7282223874948725610,524288 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6960,i,2149125464829186390,15312900277935748468,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5928,i,5633773059282412205,3668207384822077215,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,9062281435054854911,4159207203527719225,524288 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7120,i,4617064158401614768,8974689752560147010,524288 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7152,i,13361083786474570177,9640339452825794496,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5852,i,18040064051283411394,4086719907779388669,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6500,i,13515817075492819612,7972101382362927037,2097152 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7436,i,10487639402078588095,5313127460023627114,524288 --field-trial-handle=1924,i,1867557822578813453,15061277203739152264,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:14
  2⤵
  PID:2544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1004

C:\Users\Admin\Downloads\UstrарреrUХ64-v.6.456\ustrррruХ\ustrррruХ\UstrарреrUХ64-v.6.456.exe
"C:\Users\Admin\Downloads\UstrарреrUХ64-v.6.456\ustrррruХ\ustrррruХ\UstrарреrUХ64-v.6.456.exe"
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
Size 373KB
SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
MD5 7eb1501498252ec1a30118a2d3917c94
SHA1 b275a098ab3e050e2b4ac71eac10c238c2365c45
SHA512 8f5831b6bfeaea74aba0d23b684687e0a308f51f1528859535c9df335367b946b6be42500ce637e77baff40795bbf152e24abcfcee227c6d9d0e490412e09d26
SSDEEP 6144:bBJYkBiu4su2hIklCVm8ZiLHBd0R+2jBLX47rD+CNOgtU28xNAoWclJ/lo31jjuQ:bfWV22kvnBSw2FLIPDVNfN8nWclJ/Md9
TLSH
T100842306FA0DD6F4A7A40DDD2990A3E04D1372444CFC4A347B8523B9DDE3AEF4A159AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 55e27af88896b10eb7eb0779ec4e733fa787329d8ff1caba08832d7be581ba80
MD5 39a66abfa8e7a31e9f0448889b92ba31
SHA1 4a48506d322feaf143859e31abca9336186ee85d
SHA512 75d88859f1978d5023b024615bc5dc1a8424431dcba5fe0c18972aeefb100eead0c1d294fb559d89d2dd32d01294f5ac978f327345feb35f1c8b78184dff6b45
TLSH
T1F5E0A71966E05364CB325A30547C1E9833707E6189391BC77DAD725CEA535F60732456
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 4cfb4a93e48ebb53017df6303f69de36f77be47d18d54aeddcc6c789818f5896
MD5 af428c94e658ac733971714ffc4f4744
SHA1 10bcd4191c42f66a2bd13c54f0c912c881819120
SHA512 0362f0893d832be0f9434626e84c4cb012a5712c21741582e503d9854cbcc27b7fed77e584a8431347b706201bf54dd4c63141d6093698f5b6ea8bac77493122
SSDEEP 192:DpC0BDHdVegf+KWGGs/SUHB/ZjolZTrr2LSBK:DpC0BDHdVegf+KWGGs/SUHB/VolZTrry
TLSH
T156E19BB7C3EA866DD81116F9A6252E1FCE2D0A1852183C2789D8BF4F97E2472E20155E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b67dc3bd4470c785227340b47583e7a7cccf244869e497b94479427c4ab38c1d
MD5 6ee41792f6c9fec0d65da574c390e331
SHA1 c3feb0b0825695cc8ec2bc2075a20d684ff4eccc
SHA512 8155f690dc1ffd7e687b5a51d4ed3289b337f21d8228c0b39c7a10eaa4816bed3d124081a38ad6388e0203c6bc93e6b614091f7fc81952995a233659d4b7912b
SSDEEP 192:ZRpZoQvv7uvAPRp2NZ6G9UHsb+WNpI0s6Mj2HYS+VyIsnAUgg7:ZRpZfnK6XAfGw6Z2h2K
TLSH
T12832955FAA10657B6DCBD229F966B793D2F6102136E02E84EBFC8E2C24D75CD6213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f7f27a68f437b533c99567ecc52d2ac6ddbfa64c99e196669ab3da00842e4ac9
MD5 7d2af5b60e277413a4eee9b5107e9950
SHA1 bbcac878d561fa5537881d8d336f5d03729be532
SHA512 7495ff8c90a5cd42c48f533c2c1637e04fc33411e8189d49b84624300e65ae30d3cdfa7003341f91319dab423a1459679f73fc1c8f0637885bb01149b6175a27
SSDEEP 192:nRpFoTvv7vvqPRpYNZMmG9UHsb+WNpIZ+OgXpMj20QS+VyIsnAUgGSU:nRpFOn7UX2qGw9lK2u2jU
TLSH
T17442A65BA910697B6DC7D229F956B793D3F2102236E02E84EBFC8E2C24E75CC6213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d7f6261e9de8748f301b8540177fab15707c37a5a738372fce933a336872a3f6
MD5 89acb8388749ba98152a118ca7e10889
SHA1 241166d2707c7a2d72fb4b0822ef79f09be012d5
SHA512 c96690276c6249df8179c314b03726449731c8a25403d9ef0627f2ec0cf1dc323304c23b813fdf75f01f94de38c5ed422afcfc2a6fcd7d4a03801b79bbb09596
SSDEEP 192:ZRpFoQDv7vvAPRp2NZ6G9UHsb+WNpI0s6Mj2HYS+VyIsnAUgg7:ZRpFf776XAfGw6Z2h2K
TLSH
T12032855EAA10697B6DCBC229F966B793D2F6102136E02D84EBFC8A2C25D75CD6213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 50ce6f47e5efb74e2a7aa1cdebb03bb65cc9c03622412658ccb3abb671ba3f50
MD5 c19bf12e73c077f491eb9a58c1895c02
SHA1 8364bb8628b35c9251c1a4cb8e80331de18d8e42
SHA512 b4e115d9045f6cbaf8b42c45b543c748a1fd354fc850046b1e1250ff896c3bf292f026fce8c7eb90837169ce053a1cd480e62ba0e49ed67283185aff5405ef5d
SSDEEP 192:ZRpFoQDv7vvqPRpYNZ6G9UHsb+WNpI0s6Mj2gQS+VyIsnAUgG7:ZRpFf77UX2fGw6Z2q2w
TLSH
T13B42A55FA910697B6DCBD229F956B793E2F5102236E02E84E7FC8E2C25E75CC6213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 93785f5a55dd4064becb4f1cff2db93ee5c453069390cd1f175b14efbc7c3712
MD5 3f745d2e721c8e8653083d0942fd1e3b
SHA1 65c5deb319ad77fa2904b9e80a68747d89661424
SHA512 1054802f590f58b87fcf7dd07e0c496be092915ce6b1963537363cc344b69aa858c5224a631afcd5370a01ccfdb24fd88e105054f3077d30b55a845f9d252488
SSDEEP 192:etK4K6nP7KxkXqK4I40pUZNCgVLHrKHfFKslEOlbXzKD/0T+ErUkKN9mO5a1AfTH:oKj8P7KxkXqKf/pUZNCgVLH2Hfgslxbg
TLSH
T10132EA67948D9E3B4FD8D518CC176B8B6CB4019673780824A6FF9D0403A67CE114A6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0437f013d4205f887a44d044302a0d03930e10ba2c210ce5f2ea52fd1a23c714
MD5 40a5ad3dafcae498a70dbaa5a9683cab
SHA1 5bf2f1109c4575d39a0307de3f28fe2958c18316
SHA512 451926ebf8416da6845e6e4a61ad260b16029ebdaf58189cb537ef9188157d6d81d4761f5a00122107ffd79691c945408a86681cdc48197c3635a6738dff6f48
TLSH
T112B01240C1865A10C88081B0224F904E22405E2A81000356D3D0F6A69C430E05230B00
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 153B
SHA256 cdb0151f01b8288d40c0c9c5872469c3ef59e2fbc7667a1dd755d432048dc795
MD5 8fce00d98687b0f67c899f692269be91
SHA1 6db030f752efab92cc100d6ab0e4687626b1bf36
SHA512 abb17457ac4a7cee7bd80441f8ef0ec17c40a9c1be49dd7c8ea73eb88dbf95b59e2765d1fb0b60631af9010f6f6e7e662af057d81842bac6dbafeb60706750d3
TLSH
T15CC08CF30811494A8B34DBCD3028B24CC30F818C9CC0CDF0D009810161346228412934
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 237B
SHA256 060718432290d52fab0d574ae60de5fcc3c6b198c6aae705ab2f4151ea036583
MD5 686451b164de4cfc87a2f835269ad1f8
SHA1 28efd5f71a4b967d830ab7318ad671b9ec0aabae
SHA512 dfafd7fe40f8e046fe6907a80cb00f03124987486c9c13b2c3dee6921524734476e750f5f8ad25e4e53e1b229ff6275388aa503cec1bcd68ec86393e615b07f4
TLSH
T1ABD0A7A65672496A5B309BCA7064B18C821B5A5DACC4CCF4D80EF1516074212C915A74
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a1e76.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5a1e76.TMP
Size 160B
SHA256 b3418ee2498faa5198a3eb45677ade07b5e0657cba9f964b72a3cc5ba7510379
MD5 0b3cc080950fa5a9cb7b5b3524d4201d
SHA1 81f9f6a946eed8542d3df43cab7d5349ad3cdf6b
SHA512 81aa131fc85965ae5b580b0ad1e05e49b45c5a94e5ecd9505780f4b14546f384ae9ceb40a132048e5de1dd35f6a0d1cd16ab7e1559070730cc208ed0379ebeaa
TLSH
T10AC08CB30821084A8B309ACA2028B28CC32B8C9C9CC4CDF0C00AB20161346238115934
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 fc5566ab16a1ffb93e893e16da90f00024ea7099a48b3d3f609baf7fa96da7b4
MD5 32dd75c6332747120838e7bdf5726e25
SHA1 dc75b16f49e1f25930eed0e62fffb927d613e7e4
SHA512 91e83122098272b8506ee8acac49306e91877ffb2a9e890645073a059e95890541896f8c980567bed0126a2d1429e902293abfa91c95fa7cdc4b8654a3f6d5cc
SSDEEP 96:gC6Md+qKJku7fby2f2eaPphrn3RDotok5Z3DWB6AGyvODqLI/bjv4a:gCjAJr7fbyVlFDUDxGkFqLI/bH
TLSH
T10AA11A72B4664C3799B7D448B6123F43CFB4B2A77962ABA4EADD1F0C10E74E80742117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 602c37caa2757dc4143e82146ac0e0785ff556cac646dbbf75e470d957b5f8a9
MD5 fd00736313922e2a30c0beff4273cd94
SHA1 064452c8fdaec18f058b8237b0810bb9789f5ea0
SHA512 e66348e8bfc27956cecc14bf4b160f99650511cfc15e23ec1fda4c97d95581c21b3352dfdcae6e827ebb7f771c36e9bd64aa86ed9c910e80e9ccb77209452a07
SSDEEP 96:CbJ6Md+qKJku7fby2f2eaPphrnzSl8h4otop5ZItDWB6AGyvODc38aIdRNC39IS2:CtjAJr7fbyVl1iU2EGkFc38aIduCOM
TLSH
T14EC1F9B1E86E5C7B5EF3A448B1032E43CEA4626B7955BE68EAE94F0C00E74DC4742127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 29cf6c89d1a67c6462f6f56cb32005475ed342305ac5e90d3f1ab38cbf46f5e9
MD5 4518ffded2b0eb60039b7a9c8ee2b3b3
SHA1 0bb690218fdb5fba457007af240cc4a7ef4171da
SHA512 7aa55db29a5ba23ec1b88162059c9484fe1dace12e2e9af3194c403a174b6e071f84c419a0552070229736b45a26cee43c15d6ecc8eab45e087b9aac3276f798
SSDEEP 96:CC6Md+qKJku7fby2f2eaPphrnzSl8h4otop5ZItDWB6AGyvODcyXxwzjQ4cJ1aIt:CCjAJr7fbyVl1iU2EGkFcmxoQ4A1aIQa
TLSH
T131C14C72F87A6C7769F3D458B4032E43DEB4B2AB6A51AE64DADA0F0C00D70EC0742117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e27c95f4f24f969c88f87f5d7b9a3e29b9c8df6ff39b773f777422e3e5fc5786
MD5 b8be7b6e2be6f8ee26ddcc43a1a2ba2f
SHA1 b1acdb374bd30b953a878a87aff4986887ab5720
SHA512 f1bb94806443410d132ae3104463c5f8a24b675e07a543d3db7b75002590aa18cdc6adf09293cdc3dbde4fe953783c340b46b52859991e4550a95f9127816c66
SSDEEP 96:CbJ6Md+qKJku7fby2f2eaPphrnzSl8h4otop5ZItDWB6AGyvODcyXxwzjQ4cJ1am:CtjAJr7fbyVl1iU2EGkFcmxoQ4A1aIQa
TLSH
T16EC13A72F86A6C7769F3D558B5032E43DEB4B2AB6A51AE64DAEA0F0C00D74EC0742117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 c520579537f7cac05b1d4d46046a5e1d19cbcd6db000b3417f0de7f899cd4235
MD5 d508d499f6ce070b250a55309856eb16
SHA1 60bcb6475db6fdcb63e4a65c387217e23890c614
SHA512 f10f6083e36af3c12b5af1434384c07e2f26009c436dfcb71a7bc19cbe917a8aecdd112b0b1b595804a7b5c17327a295c023de5958a204fc36b4dc2c128fece2
SSDEEP 96:CbJ6Md+qKJku7fby2f2eaPphrnzSl8h4otop5ZItDWB6AGyvODc5TaIdRNC39ISa:CtjAJr7fbyVl1iU2EGkFc5TaIduCOM
TLSH
T19DC1F9B1E86E5C7B5DF3A448B1032E43CEA4626B7955BE68EAE94F0C00E75DC4742127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 507f0b185043e683d2b03a02cda6710f45df4b7e90490aa4bacbcc54e4b6b7ef
MD5 20067febb939d714a559ff78c9ffa058
SHA1 dcbf6078a3860804609110e2fac4eb75352a6d64
SHA512 af72b8097ff61cfbce318cc218efeb4fdd370cb425c6ced098fe06a0ea2b99082a8e5d5d9bd15dd76da9160dc6f1becd4530f9265e4cdafbf599a2696d311fcc
SSDEEP 96:CbJ6Md+qKJku7fby2f2eaPphrnzSl8h4otop5ZnDWB6iGGfvODc5TaIdRNC39ISa:CtjAJr7fbyVl1iU21G7vUc5TaIduCOM
TLSH
T1C2C109B1E86E5C7B5DF3A448B1032E43CEA4626B7955BE68EAE90F0C00E74EC4742127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UstrарреrUХ64-v.6.456.zip.crdownload

Path C:\Users\Admin\Downloads\UstrарреrUХ64-v.6.456.zip.crdownload
Size 2.8MB
SHA256 f4e4ed316f7b1c6bc570abf628390bdd095bb0875641c938107962bb785dd002
MD5 313bd44cd3fb391602db4f691bc64325
SHA1 2a2aa6ca1123e70b806ec0d5c0edc916481e82b6
SHA512 49ae6259893b5875293df39d3e7ae405018f9137cd2f65e0da48a1b72235ff7a4b77833b3ca96796806fbceee18b620430489636dc2a6bb71049e328f7c3cb5a
SSDEEP 49152:6B9NCGa301TCm9J0u00I9MAbqSiXiThyrrU1sx9tZ8oyCfJiaslodjPm0TDjsXaM:6HAGDwb2AbAfrg1sxNmCfJiasGdrDnEl
TLSH
T18ED53395107E11E66FABED664870F362D0E4AC8AC5B400B60F36A4D4CACC52C7FDD9AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1488-298-0x00007FF9F1930000-0x00007FF9F1C6D000-memory.dmp

Download

memory/1488-503-0x00007FF9F1930000-0x00007FF9F1C6D000-memory.dmp

Download

memory/1488-520-0x00007FF9F1930000-0x00007FF9F1C6D000-memory.dmp

Download

memory/1488-350-0x00007FF9F1930000-0x00007FF9F1C6D000-memory.dmp

Download