33765cb208fce19529002bb341f1f1251ff6f672c722004a0799927ceb255d1b

Analysis

user interaction
yes
max time kernel
510s
max time network
509s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bhXjBlcr.exe
Size 1.9MB
Sample260727-vd64mscb48
SHA256 33765cb208fce19529002bb341f1f1251ff6f672c722004a0799927ceb255d1b
MD5 661998d75e30bdfb1ad7c71ab9b23e6d
SHA1 db0452f1e3843d2ea96e4607516e6392dc0c7bd8
SHA512 a2261f898f3c8f4941ba1a039d81723032dd505b03e634ea92d1eadba259401441620c0a37e6f510c968f497c318cd7fc4f0668f45a33e2b5688be4c76bd0a20
SSDEEP 49152:BpIrOzD9cRs3QXkf8Kiqfr1nDz4sQAQQqzrOzD:47ed8qfrVzHEQq3
TLSH
T18E95D02B779218F8D2ABC175C9969771E632B8160324EF9F0794CB731E22D544A3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation ransomware upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	bhXjBlcr.exe

Executes dropped EXE 2 IoCs

pid	Process
4172	OneDrive.exe
4280	MemCleaner_64.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com
5	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4172 set thread context of 7748	4172	OneDrive.exe	128
PID 4172 set thread context of 7492	4172	OneDrive.exe	136

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c560-29.dat	upx
behavioral2/memory/4280-33-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/4280-35-0x0000000000400000-0x0000000000407000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6492	chrome.exe

Checks SCSI registry key(s) 3 TTPs 25 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296449759240831"	chrome.exe

Modifies registry class 47 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\scorpio_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\scorpio_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\.scorpio\ = "scorpio_auto_file"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\scorpio_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\scorpio_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\scorpio_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\scorpio_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\scorpio_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\.scorpio	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{263EB09F-81F0-41C6-95AB-65D6A515ABCB}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\scorpio_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3200	NOTEPAD.EXE
8140	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4280	MemCleaner_64.exe
4280	MemCleaner_64.exe
4172	OneDrive.exe
4172	OneDrive.exe
4172	OneDrive.exe
4172	OneDrive.exe
4280	MemCleaner_64.exe
4280	MemCleaner_64.exe
4292	chrome.exe
4292	chrome.exe
4172	OneDrive.exe
4172	OneDrive.exe
4172	OneDrive.exe
4172	OneDrive.exe
4292	chrome.exe
4292	chrome.exe
4280	MemCleaner_64.exe
4280	MemCleaner_64.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	bhXjBlcr.exe
Token: SeDebugPrivilege	4172	OneDrive.exe
Token: SeShutdownPrivilege	2184	explorer.exe
Token: SeCreatePagefilePrivilege	2184	explorer.exe
Token: SeShutdownPrivilege	2184	explorer.exe
Token: SeCreatePagefilePrivilege	2184	explorer.exe
Token: SeShutdownPrivilege	2184	explorer.exe
Token: SeCreatePagefilePrivilege	2184	explorer.exe
Token: SeShutdownPrivilege	2184	explorer.exe
Token: SeCreatePagefilePrivilege	2184	explorer.exe
Token: SeShutdownPrivilege	2184	explorer.exe
Token: SeCreatePagefilePrivilege	2184	explorer.exe
Token: SeShutdownPrivilege	2184	explorer.exe
Token: SeCreatePagefilePrivilege	2184	explorer.exe
Token: SeShutdownPrivilege	2184	explorer.exe
Token: SeCreatePagefilePrivilege	2184	explorer.exe
Token: SeShutdownPrivilege	2184	explorer.exe
Token: SeCreatePagefilePrivilege	2184	explorer.exe
Token: SeShutdownPrivilege	2184	explorer.exe
Token: SeCreatePagefilePrivilege	2184	explorer.exe
Token: SeShutdownPrivilege	2184	explorer.exe
Token: SeCreatePagefilePrivilege	2184	explorer.exe
Token: SeShutdownPrivilege	2184	explorer.exe
Token: SeCreatePagefilePrivilege	2184	explorer.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4172	OneDrive.exe
4172	OneDrive.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
4292	chrome.exe
4292	chrome.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4172	OneDrive.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
2184	explorer.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe
7220	taskmgr.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3532	StartMenuExperienceHost.exe
2184	explorer.exe
2848	SearchHost.exe
4884	OpenWith.exe
7220	taskmgr.exe
7220	taskmgr.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4280	4172	OneDrive.exe	94
PID 4172 wrote to memory of 2184	4172	OneDrive.exe	96
PID 4172 wrote to memory of 7036	4172	OneDrive.exe	103
PID 4172 wrote to memory of 4292	4172	OneDrive.exe	105
PID 4292 wrote to memory of 6260	4292	chrome.exe	106
PID 4292 wrote to memory of 6460	4292	chrome.exe	107
PID 4292 wrote to memory of 6492	4292	chrome.exe	108
PID 4292 wrote to memory of 6512	4292	chrome.exe	109
PID 4292 wrote to memory of 2724	4292	chrome.exe	110
PID 4292 wrote to memory of 6672	4292	chrome.exe	111
PID 4292 wrote to memory of 5760	4292	chrome.exe	112
PID 4292 wrote to memory of 6796	4292	chrome.exe	113
PID 4292 wrote to memory of 5732	4292	chrome.exe	114
PID 4292 wrote to memory of 4876	4292	chrome.exe	115
PID 4292 wrote to memory of 6316	4292	chrome.exe	116
PID 4292 wrote to memory of 6164	4292	chrome.exe	117
PID 4292 wrote to memory of 1196	4292	chrome.exe	118
PID 4292 wrote to memory of 3684	4292	chrome.exe	119
PID 4292 wrote to memory of 3996	4292	chrome.exe	120
PID 4292 wrote to memory of 7292	4292	chrome.exe	123
PID 4292 wrote to memory of 7304	4292	chrome.exe	144
PID 4292 wrote to memory of 7312	4292	chrome.exe	125
PID 4292 wrote to memory of 7452	4292	chrome.exe	126
PID 4172 wrote to memory of 7748	4172	OneDrive.exe	128
PID 4172 wrote to memory of 7748	4172	OneDrive.exe	128
PID 4172 wrote to memory of 7748	4172	OneDrive.exe	128
PID 4172 wrote to memory of 7748	4172	OneDrive.exe	128
PID 4172 wrote to memory of 7748	4172	OneDrive.exe	128
PID 4172 wrote to memory of 7748	4172	OneDrive.exe	128
PID 4172 wrote to memory of 7748	4172	OneDrive.exe	128
PID 4172 wrote to memory of 7748	4172	OneDrive.exe	128
PID 4172 wrote to memory of 7748	4172	OneDrive.exe	128
PID 4292 wrote to memory of 7760	4292	chrome.exe	129
PID 4292 wrote to memory of 7776	4292	chrome.exe	130
PID 4292 wrote to memory of 7984	4292	chrome.exe	131
PID 4292 wrote to memory of 7992	4292	chrome.exe	132
PID 4292 wrote to memory of 8004	4292	chrome.exe	133
PID 4292 wrote to memory of 7304	4292	chrome.exe	144
PID 4292 wrote to memory of 7684	4292	chrome.exe	135
PID 4172 wrote to memory of 7492	4172	OneDrive.exe	136
PID 4172 wrote to memory of 7492	4172	OneDrive.exe	136
PID 4172 wrote to memory of 7492	4172	OneDrive.exe	136
PID 4172 wrote to memory of 7492	4172	OneDrive.exe	136
PID 4172 wrote to memory of 7492	4172	OneDrive.exe	136
PID 4172 wrote to memory of 7492	4172	OneDrive.exe	136
PID 4172 wrote to memory of 7492	4172	OneDrive.exe	136
PID 4172 wrote to memory of 7492	4172	OneDrive.exe	136
PID 4172 wrote to memory of 7492	4172	OneDrive.exe	136
PID 4292 wrote to memory of 7892	4292	chrome.exe	137
PID 4292 wrote to memory of 7896	4292	chrome.exe	138
PID 4292 wrote to memory of 6560	4292	chrome.exe	139
PID 4292 wrote to memory of 4760	4292	chrome.exe	141
PID 4292 wrote to memory of 7476	4292	chrome.exe	142
PID 4292 wrote to memory of 6388	4292	chrome.exe	143
PID 4884 wrote to memory of 8140	4884	OpenWith.exe	146
PID 4292 wrote to memory of 8408	4292	chrome.exe	156

C:\Users\Admin\AppData\Local\Temp\bhXjBlcr.exe
"C:\Users\Admin\AppData\Local\Temp\bhXjBlcr.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\PROGRA~3\SYSTEM~1\OneDrive.exe
C:\PROGRA~3\SYSTEM~1\OneDrive.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Users\Admin\AppData\Local\Temp\MemCleaner_64.exe
  "C:\Users\Admin\AppData\Local\Temp\MemCleaner_64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2184
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe
  2⤵
  PID:7036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --disable-web-security --disable-gpu --disable-software-rasterizer --force-cpu-draw --no-first-run --user-data-dir=C:\temp\hvnc_chrome --new-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\temp\hvnc_chrome /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\temp\hvnc_chrome\Crashpad --metrics-dir=C:\temp\hvnc_chrome --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0xac,0x140,0x7ff9144fc728,0x7ff9144fc734,0x7ff9144fc740
    3⤵
    PID:6260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\temp\hvnc_chrome" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAQAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --metrics-shmem-handle=1628,i,15043697841633009856,6879169650315660747,262144 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:6460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\temp\hvnc_chrome" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1876,i,16582693188144862336,10219109937839625373,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,4857567038170581750,13830778987679579847,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:13
    3⤵
    PID:6512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2904,i,1946641567178257117,8623633107504236768,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:1
    3⤵
    PID:2724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,11229511140338130754,13308240809300717956,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
    3⤵
    PID:6672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3144,i,16596196995266703864,12119994232957700600,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    PID:5760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3172,i,4161465268712194358,7132893083533304858,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:9
    3⤵
    PID:6796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3892,i,4415671493160957581,6889675172969790764,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:9
    3⤵
    PID:5732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4088,i,1766357698401617400,11624572171493168778,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
    3⤵
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=4384,i,7486335218160148178,1885546732681139999,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
    3⤵
    PID:6316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,9179638475326542505,5507184666730590770,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
    3⤵
    PID:6164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4964,i,97644163680046633,12224686036147840405,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:1196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4988,i,5717734341955385319,16454552887108297012,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:3684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4992,i,41645556455077614,5288395019387631531,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5132,i,4175962762891725970,53079932639561940,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
    3⤵
    PID:7292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=4980,i,1470084615060637516,866934093702485002,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
    3⤵
    PID:7304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5084,i,8527725070532629803,14119164125991204302,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:7312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5020,i,263300768668305249,15880374552222764220,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:7452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5116,i,17146194419290398405,467991021413275531,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:7760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5340,i,2367327475870449543,1576409297450150924,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:7776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4968,i,6762784582340256631,492054918690563901,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:7984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=4088,i,12983131577599568090,13305298775707231410,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:7992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,1124920745459954200,10576870705979948578,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:14
    3⤵
    PID:8004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=4992,i,5160360127380329176,5022445933847298746,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:7304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,17668813311532536472,4238912679580933185,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
    3⤵
    PID:7684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4972,i,7442009230645349147,18172736767275192745,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:7892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5028,i,18428524350253515970,8117100407552007630,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:9
    3⤵
    PID:7896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\temp\hvnc_chrome" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5116,i,4518656536077069120,13016940618359843777,2097152 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:9
    3⤵
    PID:6560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,2277601024610659396,1499181436000026884,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
    3⤵
    PID:4760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5064,i,9358966739167450134,11735901017984023818,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
    3⤵
    PID:7476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,9181493887956622790,17281464400989411755,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:6388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-sandbox --user-data-dir="C:\temp\hvnc_chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=4340,i,17531573343094773776,9660847978243256173,524288 --field-trial-handle=2064,i,4802590314250700954,6628405797322539127,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:14
    3⤵
    PID:8408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
  2⤵
  PID:7748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
  2⤵
  PID:7492

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3532

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:7552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:8096

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:7304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\UnprotectUndo.docx.scorpio
  2⤵
  - Modifies registry class
  - Opens file in notepad (likely ransom note)
  PID:8140

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\READ_ME.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:3200

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:7220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\ProgramData\SystemData\OneDrive.exe
Size 1.9MB
SHA256 33765cb208fce19529002bb341f1f1251ff6f672c722004a0799927ceb255d1b
MD5 661998d75e30bdfb1ad7c71ab9b23e6d
SHA1 db0452f1e3843d2ea96e4607516e6392dc0c7bd8
SHA512 a2261f898f3c8f4941ba1a039d81723032dd505b03e634ea92d1eadba259401441620c0a37e6f510c968f497c318cd7fc4f0668f45a33e2b5688be4c76bd0a20
SSDEEP 49152:BpIrOzD9cRs3QXkf8Kiqfr1nDz4sQAQQqzrOzD:47ed8qfrVzHEQq3
TLSH
T18E95D02B779218F8D2ABC175C9969771E632B8160324EF9F0794CB731E22D544A3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 603B
SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
MD5 2510ff22aab74c2ba735738716005a2f
SHA1 306d676ad05de19254b82e221f183ff918e4902b
SHA512 b06c9137817610963efc14c36895253ac8c2eb5af5c9c5e3bdfa59fef8050d9827e4d250b571051c52d7141b4d69702cb0e23a14a114c3e163b1b5bdb2911f1f
TLSH
T1BEF0DC53D3E25125E023023D88A61BD27A33DB596FC7262B4540AE6C3E3B3002F494BC
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

MemCleaner_64.exe

Path C:\Users\Admin\AppData\Local\Temp\MemCleaner_64.exe
Size 3KB
SHA256 1cfb9036d25c9eb5cbbd7346ede1b3cb232de28fb893a533bdf7317ae59e9061
MD5 ff74750eb2cbd84c195d3fa3a708bb51
SHA1 c39364a7c5338939f160d1d37215a64811b7c072
SHA512 27e22cb92c1e25b32d3fcb07db20523680e8084bb79fb456c062267dde0cbe470601bc3c80733d43d0921876ce98414ab09c04bd3df2e44bc376d3c432ea95c6
TLSH
T19C51EA7373A81078C85E02B8A551500A3B7B74146BE7331B6F4DA9971C9659888BD072
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4292_1029438461\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

OneDrive.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk
Size 804B
SHA256 bf2bf516e2d6605431079b207f9c056edd570f2a2fcb0e9c5ffc1cb02a13822e
MD5 0e7f9969b6fc183868ea63579953a678
SHA1 ed3b9b9a464568cf49899c6fb05d1bf05f47929a
SHA512 679d2675c3d11c5c63d7f84a51579305c7e7ffa9615a26d2d300dbe2c0e7fd8c4368b8012bb7f2f07351a60e49d4f36ffed16b2e35a16deb8735d77d24e7bd79
TLSH
T12F01261A0ACA2F5DF3B74139063662395737F861FAE9831D40C419C846BC4016EA5F2B
MD5 SHA1 SHA512 TLSH

Submit Download

READ_ME.txt

Path C:\Users\Admin\Desktop\READ_ME.txt
Size 195B
SHA256 c178c2107bf870b0ece209fa3f7f43f5657b725b35f9aa33b647d5e350731eaa
MD5 13603950488b2609317e5f92a9cfec70
SHA1 626d75de6fde674f8d907611e792a497d9d76546
SHA512 8d4db46498d7867ed4365d9a8fd9b468a644b37c27680961c49a5cb2370f2705820e1ce93a784e5f3d07aff1b94e73b90236352211da40abcf89a0e786ce56f4
TLSH
T198D0027111CF165850532496102616F7A5C1072D606820767ADDE1D64F98BDF8D5A543
MD5 SHA1 SHA512 TLSH

Submit Download

UnprotectUndo.docx.scorpio

Path C:\Users\Admin\Desktop\UnprotectUndo.docx.scorpio
Size 18KB
SHA256 3edbf1daf439695d28ead34d10dec48d5d104ff98edf0c25b3b08fb7a88b61b2
MD5 e0d3cc28dab6b0950568c810e1d5ae12
SHA1 978eed64b5df2f234ead4c7e7d1e6cad2017a113
SHA512 5f3505c694118ebd9c2a1372acdf0da0b3135eaa4f70a6558cb4ff8b88b2fb0e618f2bc373977f13c38e1e3c68a77394f70978982511705305c206463695ff7d
SSDEEP 384:VGsrlmTQdqT+0tPqlSt3W5TAbc8oJlOhC5fFj+FuHJGgFZgMBOze:IsRmkd8qItcJlGqqSnFZg9ze
TLSH
T16F82C0C08E4FFBD3AF634B91F28549FB54201AC990E247F6164EE463999727C803625B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512ff43b-6f85-4b76-b109-d2494be6e6df.tmp

Path C:\temp\hvnc_chrome\Default\512ff43b-6f85-4b76-b109-d2494be6e6df.tmp
Size 9KB
SHA256 749a23be354af7775fb56c254605077225d6178f62f4554d59a4add71077e59f
MD5 3efd55f17d8c0f68a904cc08bebf4199
SHA1 66191e9bfba41e8c747ec03682a7a1ee013debf4
SHA512 5b33fec8a744247b89ff48ff3a1cd7ce72bf02c1ad79dcb66847dde9f8257d213de42006a9c3cca866f0e580fba83cfc0f36c29426f3804121ef957ecf1d0c34
SSDEEP 192:MRWTBhYv79pAPRp2MXsb+WNnh/24wCiyIsnAUgE:MRWToRUX3Xwx2JE
TLSH
T15F12B51EAC1496BB4CDAE619F9267B41EBF5202172D02E44D7FCCA1C25EB6CD2227117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\temp\hvnc_chrome\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 0db85b8511057e47ddb35cc62e7fdb7abf93d4563d63a75b02e4828e0e5d1380
MD5 54065e02c30a474c5f53661015943eee
SHA1 4da5032f868f85a484f8f0516dfe4c2e6d42490f
SHA512 78bfe5f253dd3baae83f25064e65348c1d15f4ed9762dc6a7425c8580b81a6970fbb62a46da75da05cd5f516d9b5ae199299a0bb3a9f56f7ae01cb2e48cdfb3e
TLSH
T1A0A0021422C08511CAC00275B95105C032224E258126535386F41A878AEF7E2B146651
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c3b3c.TMP

Path C:\temp\hvnc_chrome\Default\Code Cache\js\index-dir\the-real-index~RFe5c3b3c.TMP
Size 48B
SHA256 f67b68bd9223ee9b9d1403c084bc17d7710a9a7f7e332da5c14127e9479ee1ea
MD5 bc946db04347c9c8749a0bea23a26298
SHA1 88fe454d1d132b6ba7c1b3c94a60d53d224b0c41
SHA512 ee027105dccc2f3f4faa044ccc4278ba49de04ad3adf3fa3e4f4e0907efe9b2de35af63a8002bf0177bcc83c3e2ff9e3d127eafd2fccba02328472922b15caec
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\temp\hvnc_chrome\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\temp\hvnc_chrome\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\temp\hvnc_chrome\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\temp\hvnc_chrome\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\temp\hvnc_chrome\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\temp\hvnc_chrome\Default\Network\Network Persistent State
Size 2KB
SHA256 6bf1bae1e8a1d903e1e10ed5e97e9319c7395752dbd5328f85c5565ed9644523
MD5 7e94c820ecfce529078a652c8e7098fd
SHA1 0db2a2a523f9dd8a4b8dbc245b01a42fe54bb8c9
SHA512 39bc3923ae1e3b6d3f7b3deaf8900f9a2c521eb6cd146c69c2fdb9ceabbcf48b6bb0f42d69a715f7d1fb83c56dfd7263b5700a6f721661330f4173a91171f27e
TLSH
T197518EF7C3D8897D895156F4EB252F2BCD6D0A15522C3C92C8E4AE5F53E19B2D20068F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\temp\hvnc_chrome\Default\Network\Network Persistent State
Size 2KB
SHA256 6ae8d88c24f622279795783c82ebc20462211a4e78a5b6c5c70b1110c124461f
MD5 f115206e0b937114f6ac478019ef77ee
SHA1 d9127e1212934a9e0aa0fc7844f6424c7de4cf4c
SHA512 c413f64eacccb47447cb02a63415a854b528880fbd272753863f7d52e48326f4c84b9ed84d84f36853a46b585b3612124a8eb94653bb4f5399740322d39248fe
TLSH
T109518DB3C3D88A7DC95156F4DB256E6FCD6D0A15522C3C52C8E4AE4B57E29B2D20024E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\temp\hvnc_chrome\Default\Network\Network Persistent State
Size 2KB
SHA256 4ac5aaff18effaf202f77b8ae4d00119c5158f56ee9ca230342573b424fdfd12
MD5 003e44fcfb87cbcda6d7ff534b2509b8
SHA1 765b7350a7a278dec773f3d91b8250601820f229
SHA512 b90248320251caa78ccfe2fc3cc633fbf5f814e1967ce7af467b49a71eecfc6242b283c83327e31caf374131a5e7e91cfd23321c3233771fce3e01e4689c0ca6
TLSH
T155418FF3C3D8897D895156F4EB252F2BCDAD0915521C3CA2C8E4AF5F53E19B1D20054E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\temp\hvnc_chrome\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\temp\hvnc_chrome\Default\Preferences
Size 9KB
SHA256 c4d85706049eb4e1d7f1e19e2a0f8e3b7c94568471349de87d63be8ca5130379
MD5 4e915183c96ac58d2d57da0e753499e5
SHA1 c0ea0a0f860d4f1818fca6f1e44fa6131e8f06dc
SHA512 d773066a8ca975fb22b4480674e2d1b619d731892a9395b4601b9b0d63c14b25f9ba40ea26c1206bdf140f1446dfc16b239269cbe4a38817189d654e0fb99518
SSDEEP 192:MRWTBh+v79p8PRp6MXsb+WNnh/2WwoiyIsnAUgE:MRWT2RcXTXwx2dE
TLSH
T17012A51EAC1496BB8CDAE619F9267B41E7F4202176D02E48D7FCCA1C25EB6CD2327117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\temp\hvnc_chrome\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 afb07a19ec60f572c4af4345d3c56a892da638234edfa69ec35f89b3411b0e6f
MD5 14106e35b8d866e79533c380e4dfab8d
SHA1 05fc7104b9d580c66f6fd66904a18d790e4e4c63
SHA512 b004374b24e77e4a7d9fd4a7e6eb7b1fe242bc0fe1c165149a85016fa84f641bd8219b9a814bab25ec3d7600fc30f26f27a94781cdea6ca0b4349994d0dbb61a
TLSH
T1E5B01208C44B1B00D84085702109904922505E3DD050874387F05D99DC870E04356104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c5bf3.TMP

Path C:\temp\hvnc_chrome\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c5bf3.TMP
Size 72B
SHA256 d570591c3a387ac7cd641e63f602378f556a3744d1f4121520e55018bfd41016
MD5 5519fb79f9191fb336d435e3a5842ea0
SHA1 853e3c07b3da4cdde4b3600bfb218d1086f19caf
SHA512 88fa8104bdf966816ae596228d65882ef22f42881ec3a6117a34d0b5fa6bbbd43486598b2bcc0faa1aa3f7978204996e5f563aa00aa9c9f24e83d01e5625853d
TLSH
T1D5A0022212408521C22042B02805C3881244B96DD0204213BAF183479CA50904A11148
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\temp\hvnc_chrome\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\temp\hvnc_chrome\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\temp\hvnc_chrome\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 6d7027b5bba3696e81f583677ae51df90c5b9d1a8caac267a0e29c30932da6a0
MD5 4f82af18fc61a1f9da503b234479322c
SHA1 331bb9059404f7befed986bb1c5b3ee30b0130fc
SHA512 ec10baecbeb9d38a0011bb31a61d34f706c9dc36f5f7696beb2dcb117ae48b87603d78425d2aa67ae2eac1cd0151a54cb7f379f05553c4866814012a2391ca73
TLSH
T142A002119AC41966CD6052B070B50981279358749555831755B10484D9DF2C05B12105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c577e.TMP

Path C:\temp\hvnc_chrome\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5c577e.TMP
Size 48B
SHA256 a4f61a299d32bf5f3e8c41aa7191ace56b6cfd96c2a3fd3210d4950d0bbd017e
MD5 c0ada03b593cd583db1606f9167ccbcb
SHA1 1094d9b623b9afaedf1a5798a0acd898987cba05
SHA512 486f95bb33e684a8a20f9a2475a2404ca8184be378f879039154aba166f1954b97f66753f114880f28afbb701c0ee188036c321a4b8727b70e38193465a735c1
MD5 SHA1 SHA512

Submit Download

dc1a549d-4cf5-4855-9e06-e566376b1d5a.tmp

Path C:\temp\hvnc_chrome\Default\dc1a549d-4cf5-4855-9e06-e566376b1d5a.tmp
Size 17KB
SHA256 fdcd59c782f51b9d2646fca44ebcee29b83c3e3d007ddbb76c6c3de9e2513384
MD5 2b48712acdc73d635f340de647672b9a
SHA1 a00306ddf341b88ab612a30f743ebada39a95159
SHA512 0af6e6dd8a306fff18926a83c96671c8b39aa0d3e6a76bbd82c5fbb881ab55356a64edbe8111473758d47d051d54546b67a0e71488c8d53d3c9ddfbd7d6c947c
SSDEEP 384:n5jNE7KxkXqKf/pUZNCgVLH2HfgslXO7pLuLci39YXODr2+ErU3T6HGL96B8:nJNE7KxkXqKf/pUZNCgVLH2Hfgs9O7p4
TLSH
T116721A677C4C9A7B0F94C9CDD8177A4FADB5024B66ED886483FA881903D5ACB010A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\temp\hvnc_chrome\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\temp\hvnc_chrome\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\temp\hvnc_chrome\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\temp\hvnc_chrome\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\temp\hvnc_chrome\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\temp\hvnc_chrome\Local State
Size 123KB
SHA256 66a15c3b37c276b7f68b6808b2c43c25a1fe0a4b443e82b48d6a6dbbe1e14f02
MD5 ac7a406acc49a881c5564d1ede416550
SHA1 58a7dcf13bd76fa11e28d42b91c41ce44be0b0e1
SHA512 fe073e9192a97744cbbc56ed80a767b61bbbfec5a806722932a84a23295a49a395dbc6400ca23834de59112cbdb299a06b88fccc3b5b723e21d129e9ff3dd638
SSDEEP 3072:puu7LlLRwvtQl6e2luf0xNrIBgMLmwZaiEU:puu90tQJzf4pcgMLmoN
TLSH
T133C312C78CA5A9F81487EF2DF03BAB0959EEE455F4C6CBE121425D0209D11DD068BD8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\temp\hvnc_chrome\Local State
Size 124KB
SHA256 ae082646093c2187599d894b50724b9e289ab666c1d9b7379042b8277618e807
MD5 e5738923fedb278f9b2c6abc3e13a188
SHA1 75793a3c8d945e48143e142776d43d76315a1a97
SHA512 84c3f8d0d84dca95c603d801cad8b8aabb5d39cd1d66e2fc6a90cb29acc620a4ba0027e04dc1183b95073bf0669ad0faf97ce655728f1bf39a51e79ee76988d2
SSDEEP 3072:Ouu7LlLRwvtQl6e2luf0xNrIBgMLmwZaiEU:Ouu90tQJzf4pcgMLmoN
TLSH
T12CC312F39866A9E90857AF1DB03BAB085CFEE157F8CADBE036425D0145D11CC4A8BD87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\temp\hvnc_chrome\Local State
Size 123KB
SHA256 fdacc63a5ba3faeb8e753d0a4ec505b763e5712bdd76faf7187fa8766887b835
MD5 b021e9adce0d5ad4802decf29831de3b
SHA1 27e46cc0d4c4bac5857cd648457c805c53a688a2
SHA512 fce3e73cb39f548546c0f01eb5ff743ac9c96eff1e5e4c8c3e2fe81ae585ff80d71c9805c4d6e5ec7a7b01d2019831f047f2d9cd781196308852b21b4be46ea0
SSDEEP 3072:Quu7LlLRwvtQl6e2luf0xNrIBgMLmwZaiEU:Quu90tQJzf4pcgMLmoN
TLSH
T121C312C78CA6A9F91487FF2DF03BAB0999EEE455F4C6CBE121425D0209D11DD068BD8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\temp\hvnc_chrome\Local State
Size 125KB
SHA256 7fef8d0bd79a2bbba59beb9231df19866cfd1782ce6a771426736117473782e0
MD5 1b0de33a82adcec7f5cd1163cc9555c7
SHA1 8140c65d32e7fed92743b274f9db57b51afcaa42
SHA512 8d48e2629bee67ec659347b9af7ad3ecc20e7b485d97847429d055cd3271db4d869399115f5c091c944634fa259855b73ecb188663f1b2816a98ee1dc2a9e1dc
SSDEEP 3072:1uu7LlLRwvtQl6e2luf0xNrIBgMLmwZaiEU:1uu90tQJzf4pcgMLmoN
TLSH
T16AC312B39C66A9E91897BE2DB037AB054CFEE157F8CADBE035425D0505D10CC4A8BD8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\temp\hvnc_chrome\Local State
Size 125KB
SHA256 95b5496a485ad088c099886e387da3b7a57cf39ad20ab452b9c7416727a0da7a
MD5 2083bc00a1e68dd74fcc5c0544848129
SHA1 ab2dba87cfbbc699786c7ca8b40c2496a11ffff4
SHA512 67d04f9abeeb5d26df1d0d44c073507098ea87e65f881879f52427e756d78f7c1cc324ba179a7b8a65e76a563e8e2eaf50ca4a2425e2e4e3d6c5dda0983b44e9
SSDEEP 3072:5uu7LlLRwvtQl6e2luf0xNrIBgMLmwZaiEU:5uu90tQJzf4pcgMLmoN
TLSH
T1E4C312B39C66A9E90897BE2DB037AB094CFEE157F8CADBE035425D0505D11CC4A8BD87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5c1063.TMP

Path C:\temp\hvnc_chrome\Local State~RFe5c1063.TMP
Size 1KB
SHA256 005044a1132ba6f7cb4404a5a3d893d8f7025af990c36985850da5a00604742a
MD5 26749c4c9396cd7be6fddcbcc44a457b
SHA1 e3404aca4a6346dd68c2aad3bc6eac569a4eafb2
SHA512 1ea218fec46acbd71d3edf40c5025c1800bc74435f01a5500f38a27237b9d47f24d54370a0188e0604caa4492f547cbd2392fdbeee54e59905eded885c7320e3
TLSH
T1D71175B3BD5861716E49854EE202963B0D2A6337C2A2CE867ACC0E0C01EC39C2117C35
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2848-110-0x0000020D0D7D0000-0x0000020D0D7F0000-memory.dmp

Download

memory/2848-65-0x0000020500220000-0x0000020500320000-memory.dmp

Download

memory/2848-78-0x0000020D0D3D0000-0x0000020D0D4D0000-memory.dmp

Download

memory/2848-96-0x0000020D0D2B0000-0x0000020D0D2D0000-memory.dmp

Download

memory/2848-77-0x0000020D0BF60000-0x0000020D0BF80000-memory.dmp

Download

memory/3532-225-0x0000023A0E260000-0x0000023A0E8F1000-memory.dmp

Download

memory/4172-17-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4172-24-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4172-23-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4172-20-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4172-19-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4172-18-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-14-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-6-0x000001D6A5C10000-0x000001D6A5C2E000-memory.dmp

Download

memory/4256-21-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-13-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-12-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-11-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-10-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-22-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-9-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-7-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-1-0x000001D6A3DA0000-0x000001D6A3F8A000-memory.dmp

Download

memory/4256-0-0x00007FF90CBCF000-0x00007FF90CBD0000-memory.dmp

Download

memory/4256-5-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-15-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-4-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-3-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp

Download

memory/4256-2-0x000001D6A5E00000-0x000001D6A5E76000-memory.dmp

Download

memory/4280-35-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4280-33-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/7220-1200-0x0000021F64320000-0x0000021F64321000-memory.dmp

Download

memory/7220-1210-0x0000021F64320000-0x0000021F64321000-memory.dmp

Download

memory/7220-1208-0x0000021F64320000-0x0000021F64321000-memory.dmp

Download

memory/7220-1211-0x0000021F64320000-0x0000021F64321000-memory.dmp

Download

memory/7220-1209-0x0000021F64320000-0x0000021F64321000-memory.dmp

Download

memory/7220-1207-0x0000021F64320000-0x0000021F64321000-memory.dmp

Download

memory/7220-1206-0x0000021F64320000-0x0000021F64321000-memory.dmp

Download

memory/7220-1202-0x0000021F64320000-0x0000021F64321000-memory.dmp

Download